CVE-2025-4229PAN-OS: Traffic Information Disclosure Vulnerability
- 6.0MediumCVSS base score
- 0.53%Exploitation in 30 daysEPSS · top 55% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent from the firewall through the SD-WAN interface. This requires the user to be able to intercept packets sent from the firewall. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Timeline
ID reserved
By palo_alto
- 42 days later
· 42 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| palo_altoCNA (assigner) | 4.0 | Medium6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/U:Amber |
| NVDNVD · Deferred | 4.0 | Medium6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:X/U:Amber |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.
Affected products
Palo Alto Networks · Cloud NGFW
- unaffected All
- affected 11.2.0 – < 11.2.7
- affected 11.1.0 – < 11.1.10
- affected 10.2.0 – < 10.2.17
- affected 10.1.0 – < 10.1.14-h16
Palo Alto Networks · Prisma Access
- unaffected All
What to do
Solution: Version Minor Version Suggested Solution Cloud NGFW All No action needed. PAN-OS 11.2 11.2.0 through 11.2.6 Upgrade to 11.2.7 or later. PAN-OS 11.1 11.1.0 through 11.1.9 Upgrade to 11.1.10 or later. PAN-OS 10.2 10.2.0 through 10.2.16 Upgrade to 10.2.17 or later. PAN-OS 10.1 10.1.0 through 10.1.14 Upgrade to 10.1.14-h16 or later. All older unsupported PAN-OS versions Upgrade to a supported fixed version.Prisma Access All No action needed.
Workaround: If you are not using the SD-WAN feature of PAN-OS, you can mitigate this issue by disabling the SD-WAN feature. To disable SD-WAN feature, see our documentation about uninstalling SD-WAN plugin https://docs.paloaltonetworks.com/sd-wan/activation-and-onboarding/uninstall-the-sd-wan-plugin . If you are using the SD-WAN feature but do not need Direct Internet Access, you can mitigate the issue by disabling Direct Internet Access on the SD-WAN Interface Profile by backhauling your internet traffic to SD-WAN hub https://docs.paloaltonetworks.com/sd-wan/administration/configure-direct-internet-access/backhaul-your-internet-traffic-to-sd-wan-hub .
Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.
References
References1
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-18245 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-4229)Record last updated .