CVE-2025-4227 GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement
An attacker with physical network access can intercept unencrypted packets due to improper access control in the GlobalProtect app's traffic policy enforcement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-4227?
CVE-2025-4227 is a low-severity vulnerability in Palo Alto Networks GlobalProtect App, published on 13 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel.
An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one minute.
Weakness: CWE-319
Which versions are affected by CVE-2025-4227?
It affects 1 product.
Products include Paloaltonetworks Globalprotect.
How do I fix CVE-2025-4227?
No fix has been published for CVE-2025-4227 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4227 being exploited?
There is no known exploitation of CVE-2025-4227 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks GlobalProtect App
- CVE-2025-4232 GlobalProtect: Authenticated Code Injection Through Wildcard on macOS
- CVE-2021-3057 GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
- CVE-2023-0009 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
- CVE-2022-0016 GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon
- CVE-2025-0120 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
Sources
Also known as GHSA-h9qj-xx2j-6h84.