CVE-2025-4614

LowCVSS 2.7/10Last modified Oct 18, 2026

Description

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-461485.3In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.CVE-2025-461495.3In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.CVE-2025-46157.2An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authent CVE-2025-461505.3In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.CVE-2025-461525.3In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument.CVE-2025-461535.3PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU impl CVE-2025-461548.4Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.CVE-2025-461579.9An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave reques CVE-2025-461586.2An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the `setitimer` syscall CVE-2025-46161.1An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admi CVE-2025-46171.1An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin u CVE-2025-461715.4vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a suffic