Technical impact
A particular version of Trust Protection Foundation suffers from a SQL injection flaw that lets an attacker with valid credentials run arbitrary SQL statements against the product database. If successful, the attacker can read confidential information, modify stored data, and raise privileges to full administrative control of the platform. The weakness is CWE‑89, a classic input validation failure that allows malicious input to be executed by the database engine.
Affected Systems
The vulnerability applies to Palo Alto Networks Trust Protection Foundation versions 24.1.0 through 24.1.12, 24.3.0 through 24.3.5, 25.1.0 through 25.1.7, and 25.3.0 through 25.3.2, as well as all older releases that have not been patched to a fixed version.
Risk and Exploitability
The CVSS score of 6.1 indicates a moderate severity, with the EPSS score not available to gauge exploitation likelihood. The vulnerability is listed outside the CISA KEV catalog, suggesting no widely known active exploits. However, because the flaw requires authentication, an attacker must first obtain legitimate credentials or compromise an account with database access. Once authenticated, the attacker could abuse the injection to perform data exfiltration, tampering, or privilege escalation. Given the medium severity and lack of publicly known exploitation, the risk is moderate to high in environments where privileged users have inconsistent safeguards.
