Palo Alto Networks User-ID Agent Flaw Leaks Passwords in Cleartext

A newly disclosed vulnerability in the Palo Alto Networks User-ID Credential Agent on Windows systems allows service account passwords to be exposed in cleartext under certain non-default configurations. Tracked as CVE-2025-4235, the flaw carries a CVSS base score of 4.2 (Medium) and has been assigned a Moderate urgency level, with Palo Alto Networks releasing details and guidance on 10 September 2025 advising users to upgrade or apply mitigations to avoid potential privilege escalation and service disruption.

The User-ID Credential Agent collects and manages service account credentials to integrate Active Directory user mappings into firewall policies, and under specific custom configurations an unprivileged domain user can retrieve the service account password in cleartext directly from the agent’s files or memory.

The flaw affects all versions of the User-ID Credential Agent prior to 11.0.3 on Windows, with certain version ranges affected, and elevated risk is assigned when service accounts hold roles such as Server Operator or Domain Join. Exploitation could disrupt credential agent operations or enable privilege escalation, and the local-only vector combined with low complexity makes this attractive for internal threat actors or compromised hosts, according to Palo Alto Networks.

Mitigation includes upgrading to 11.0.3 or later for affected builds and applying hardening measures to restore the integrity of Active Directory integration with firewall policies.