Palo Alto User-ID Credential Agent up to 11.0.2-132 on Windows Legacy Feature information expsure

Summaryinfo

A vulnerability was found in Palo Alto User-ID Credential Agent up to 11.0.2-132 on Windows. It has been rated as problematic. This vulnerability affects unknown code of the component Legacy Feature. Performing a manipulation results in information expsure. This vulnerability is cataloged as CVE-2025-4235. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Palo Alto User-ID Credential Agent up to 11.0.2-132 on Windows. It has been classified as problematic. This affects an unknown function of the component Legacy Feature. The manipulation with an unknown input leads to a information expsure vulnerability. CWE is classifying the issue as CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. This is going to have an impact on confidentiality. The summary by CVE is:

An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The impact varies by configuration: * Minimally Privileged Accounts: Enable disruption of User-ID Credential Agent operations (e.g., uninstalling or disabling the agent service), weakening network security policies that leverage Credential Phishing Prevention https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention under a Domain Credential Filter https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention/methods-to-check-for-corporate-credential-submissions configuration. * Elevated Accounts (Server Operator, Domain Join, Legacy Features): Permit increased impacts, including server control (e.g., shutdown/restart), domain manipulation (e.g., rogue computer objects), and network compromise via reconnaissance or client probing.

It is possible to read the advisory at security.paloaltonetworks.com. This vulnerability is uniquely identified as CVE-2025-4235 since 05/02/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 11.0.2-133 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-29071). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Palo Alto

Name

• User-ID Credential Agent

Version

• 11.0.2-132

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion