CVE-2025-4235: Palo Alto User-ID Agent Escalation Flaw

CVE-2025-4235 Overview

CVE-2025-4235 is an information exposure vulnerability [CWE-497] in the Palo Alto Networks User-ID Credential Agent for Windows. The flaw exposes the configured service account password under specific non-default configurations. An unprivileged Domain User with local access can retrieve the password and escalate privileges using the service account's permissions.

Impact scales with the service account's role. Minimally privileged accounts allow disruption of the User-ID Credential Agent, degrading Credential Phishing Prevention policies. Elevated accounts (Server Operator, Domain Join, or legacy features) permit server control, rogue computer object creation, and broader network compromise through reconnaissance and client probing.

Critical Impact
Local Domain Users can extract cached service account credentials and pivot to server shutdown, domain manipulation, or network-wide reconnaissance depending on account privileges.

Affected Products

Palo Alto Networks User-ID Credential Agent (Windows-based)
Deployments configured under non-default settings that expose the service account password
Environments using Domain Credential Filter for Credential Phishing Prevention

Discovery Timeline

2025-09-12 - CVE-2025-4235 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4235

Vulnerability Analysis

The User-ID Credential Agent stores or handles the configured service account password in a manner that exposes it to unprivileged Domain Users on the host running the agent. This maps to [CWE-497], Exposure of Sensitive System Information to an Unauthorized Control Sphere. The exposure occurs only under specific non-default configurations of the agent.

Once an attacker retrieves the password, they authenticate as the service account and act with its assigned rights. If the account holds only agent-management privileges, the attacker can uninstall or stop the agent service. This action silently disables Credential Phishing Prevention checks that rely on the Domain Credential Filter method, weakening URL filtering controls that block corporate credential submissions to external sites.

When the service account carries broader privileges such as Server Operator, Domain Join rights, or legacy directory permissions, the attacker gains substantially more capability. Actions include shutting down or restarting servers, creating rogue computer objects in Active Directory, and probing clients across the network for further compromise.

Root Cause

The root cause is improper protection of the stored service account credential within the Windows-based User-ID Credential Agent. Under specific non-default configurations, the password becomes readable to a local Domain User account that should not have access to it.

Attack Vector

The attack vector is local. An attacker requires authenticated Domain User access to a host where the vulnerable agent runs with a non-default configuration. No user interaction is needed after that access is obtained. Refer to the Palo Alto Networks CVE-2025-4235 Advisory for configuration-specific details.

Detection Methods for CVE-2025-4235

Indicators of Compromise

Unexpected stop, restart, or uninstall of the User-ID Credential Agent Windows service
Interactive or network logons using the User-ID Credential Agent service account from hosts other than the agent server
Creation of unauthorized computer objects in Active Directory shortly after service account authentication events
Server shutdown or restart events initiated by the User-ID Credential Agent service account

Detection Strategies

Monitor Windows Security event IDs 4624 and 4672 for logons using the User-ID Credential Agent service account outside its expected host
Alert on service state changes (event ID 7040, 7045) for the User-ID Credential Agent service
Correlate Active Directory changes (event IDs 4741, 4742) with authentication events from the service account

Monitoring Recommendations

Baseline normal authentication patterns for the User-ID Credential Agent service account and alert on deviations
Track process access to agent configuration files and registry keys by non-administrative users
Review firewall User-ID logs for gaps that may indicate agent tampering

How to Mitigate CVE-2025-4235

Immediate Actions Required

Review the Palo Alto Networks CVE-2025-4235 Advisory and apply the fixed version of the User-ID Credential Agent
Rotate the service account password used by the User-ID Credential Agent after patching
Audit the service account's group memberships and remove Server Operator, Domain Join, or legacy directory rights unless strictly required
Restrict interactive logon rights on hosts running the agent to reduce local Domain User exposure

Patch Information

Palo Alto Networks has published fixed versions and configuration guidance in the vendor advisory. Administrators should upgrade the User-ID Credential Agent to the version listed in the Palo Alto Networks CVE-2025-4235 Advisory and follow the recommended configuration to prevent password exposure.

Workarounds

Reconfigure the agent to the vendor's default settings that do not expose the service account password
Assign the User-ID Credential Agent the least-privileged service account possible, avoiding Domain Admin, Server Operator, or Domain Join rights
Segment the agent host to prevent unprivileged Domain Users from establishing local sessions
Enable enhanced auditing on the service account to detect unauthorized reuse

bash

# Example: audit and constrain the User-ID Credential Agent service account
# Review current group memberships
net user <UIDAgentSvcAccount> /domain

# Remove elevated groups if not required
net group "Server Operators" <UIDAgentSvcAccount> /delete /domain

# Restrict where the account can log on (via GPO or dsa.msc)
# User Properties > Account > Log On To > specify only the agent host

# Force password rotation after patching
net user <UIDAgentSvcAccount> * /domain