CVE-2025-0118
Paloaltonetworks Globalprotect 6.0.0 – 6.0.11
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:AmberSummary
CVE-2025-0118 is a medium-severity Exposed Unsafe ActiveX Method (CWE-618) vulnerability in Paloaltonetworks Globalprotect. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-18 (Mobile Code) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-0118 is a vulnerability in the Palo Alto Networks GlobalProtect app on Windows that allows a remote attacker to execute ActiveX controls within the context of an authenticated Windows user. This flaw enables the attacker to run arbitrary commands with the privileges of the legitimate authenticated user. The issue is specific to the GlobalProtect app on Windows devices and does not affect the app on other platforms. It has a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-618.
Exploitation requires an authenticated user with low privileges (PR:L) to navigate to a malicious web page during the GlobalProtect SAML login process on a Windows device, involving user interaction (UI:R). A remote attacker (AV:N) can then leverage this to achieve high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H) by executing commands in the user's context, potentially leading to full system compromise for the affected user.
For mitigation details, including available patches, refer to the official Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2025-0118. The vulnerability was published on 2025-03-12.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7352
Vulnerability Data
A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate…
more
authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device. This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-18 requires defining unacceptable mobile code technologies and authorizing/controlling their use, directly stopping unsafe ActiveX methods from being exposed to browsers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent exposure of unsafe ActiveX methods via code review and design controls.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect unsafe methods but does not itself prevent their introduction.
Secure development lifecycle mandates review of exposed interfaces and dangerous methods before release.
Application security requirements explicitly call for restricting unsafe ActiveX methods and browser-zone violations.
Secure architecture principles discourage exposing privileged operations outside the browser security model.
Secure coding standards directly prohibit unsafe ActiveX method exposure and require least-privilege interfaces.