ZTNA Auth Bypass in Netskope, Zscaler, Check Point (CVE-2025-54982)

Critical Vulnerability Information Vulnerability Overview Research Objective: Investigate the security of Zero Trust Network Access (ZTNA) solutions, including Netskope, Zscaler, Check Point, and Palo Alto. Identified Vulnerabilities: Critical vulnerabilities were discovered in these market-leading solutions, enabling attackers to bypass authentication and fully compromise authorization, thereby gaining access to internal resources. Key Findings Netskope - Authentication bypass and user impersonation vulnerabilities in the BYP environment. - Arbitrary (cross-organization) user impersonation. - Complete authentication bypass and user impersonation when a known non-revocable “OrgKey” value is available. - Privilege escalation via server request (CVE pending). - Gaining SYSTEM privileges by controlling Netskope client communication with remote servers. Zscaler - SAML authentication bypass (CVE-2025-54982). - Complete authentication bypass due to Zscaler’s failure to verify whether SAML assertions were properly signed. Check Point - Hardcoded SCP key. - Access to SCP server, enabling control over client keys across multiple networks, including devices with ZTNA functionality, potentially allowing automated attacks on Prometheus SL services. All Authentication Bypass Vulnerabilities - Successful exploitation grants access to two web services: “ImpersonateUser” and “PrivateAccess”. These services allow traffic routing to isolated resources, potentially exposing boundaryless environments to risk. Recommended Actions A detailed advisory report has been published, describing the disclosed vulnerabilities, including technical details, attack vectors, and mitigation steps, to help organizations protect themselves from these threats. Emphasis is placed on the need for increased transparency and improved security practices, especially when vendors develop and deploy such technologies. Conclusion and Reflections Surprise expressed at Netskope still supporting publicly documented authentication methods that are exploitable. Reference to NCSC’s guidance on digital balance and protection of manufacturing specifications, highlighting the importance of logging standards, national log standards, and forensic data collection requirements. Call for organizations to verify that their vendors comply with these standards and ensure timely notification of any newly discovered vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

ZTNA Auth Bypass in Netskope, Zscaler, Check Point (CVE-2025-54982)