CVE-2025-0118
📋 TL;DR
A vulnerability in Palo Alto Networks GlobalProtect app on Windows allows remote attackers to execute ActiveX controls as an authenticated Windows user. This enables command execution with user privileges when the user visits a malicious page during SAML login. Only Windows devices running the GlobalProtect app are affected.
💻 Affected Systems
- Palo Alto Networks GlobalProtect app
📦 What is this software?
Globalprotect by Paloaltonetworks
Globalprotect by Paloaltonetworks
Globalprotect by Paloaltonetworks
Globalprotect by Paloaltonetworks
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the Windows system with authenticated user privileges, allowing lateral movement, data theft, and persistence establishment.
Likely Case
Limited privilege escalation within the user context, potentially leading to credential theft, data access, and initial foothold for further attacks.
If Mitigated
No impact if users avoid malicious pages during SAML login or if the vulnerability is patched.
🎯 Exploit Status
Requires user interaction (visiting malicious page during SAML login) and authenticated Windows user context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://security.paloaltonetworks.com/CVE-2025-0118
Restart Required: No
Instructions:
1. Visit Palo Alto Networks security advisory. 2. Identify affected GlobalProtect versions. 3. Update to the latest patched version. 4. Verify update completion.
🔧 Temporary Workarounds
Disable ActiveX controls
WindowsConfigure Windows to block ActiveX controls during browser sessions
Use Group Policy or registry settings to disable ActiveX controls
User awareness training
allTrain users to avoid clicking suspicious links during authentication processes
🧯 If You Can't Patch
- Implement network segmentation to limit lateral movement
- Use application allowlisting to prevent unauthorized ActiveX execution
🔍 How to Verify
Check if Vulnerable:
Check GlobalProtect app version against vendor advisory for affected versionsCheck Version:
Check GlobalProtect app version in Windows Programs & Features or via command lineVerify Fix Applied:
Confirm GlobalProtect app is updated to patched version specified in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unusual ActiveX execution events in Windows logs
- Suspicious authentication attempts in GlobalProtect logs
Network Indicators:
- Unexpected outbound connections from GlobalProtect processes
- Traffic to known malicious domains during authentication
SIEM Query:
Search for ActiveX execution events combined with GlobalProtect authentication logs