CVE-2025-2182: Palo Alto Networks Cloud Ngfw

Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days.

A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.

Affected products

• Palo Alto Networks Cloud Ngfw
• Palo Alto Networks PAN-OS: from 11.2.0, before 11.2.8 (fixed in 11.2.8); from 11.1.0, before 11.1.10 (fixed in 11.1.10)
• Palo Alto Networks Prisma Access

Published 2025-08-13. Last modified 2026-06-17.