[Palo Alto Networks Security Advisories] CVE-2025-0138 Prisma Cloud Compute Edition: Insufficient Session ExpirationVulnerability in the Web Interface

Palo Alto Networks Security Advisories /CVE-2025-0138

CVE-2025-0138 Prisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web Interface

Description

Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Edition susceptible to unauthorized access.

Compute in Prisma Cloud Enterprise Edition is not affected by this issue.

Product Status

Versions	Affected	Unaffected
Compute in Prisma Cloud Enterprise Edition	None	All
Prisma Cloud Compute Edition	< 34.00.141	>= 34.00.141

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity:LOW, Suggested Urgency:MODERATE

CVSS-BT:0.3 /CVSS-B:2.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-613 Insufficient Session Expiration

CAPEC-114 Authentication Abuse

Solution

This issue is fixed in Prisma Cloud Compute Edition 34.00.141, and all later Prisma Cloud Compute Edition versions.

Workarounds and Mitigations

No workaround or mitigation is available.

Acknowledgments

CPEs

Timeline

---