CVE-2025-0107highobserved exploitationCWE-78

CVE-2025-0107: high-severity vulnerability in Palo Alto Networks Expedition

Expedition: OS Command Injection Vulnerability

Published · Updated

Follow this CVE+ Monitor PAN-OS+ Monitor Prisma Access

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

80Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 7.7epss 78%
from disclosure to weapon
Published on NVDJan 11
VulnCheck+165d
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Green
Affected products
Palo Alto Networks · Cloud NGFWPalo Alto Networks · ExpeditionPalo Alto Networks · PanoramaPalo Alto Networks · PAN-OSPalo Alto Networks · Prisma Access
Related CVEs — Palo Alto Networks Expedition

In the same product, most dangerous first.

CVE-2024-3400CRITICALPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectEPSS 100.0%KEVCVE-2024-0012CRITICALPAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)EPSS 99.8%KEVCVE-2024-9465CRITICALExpedition: SQL Injection Leads to Firewall Admin Credential DisclosureEPSS 99.6%KEVCVE-2024-9463CRITICALExpedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential DisclosureEPSS 98.5%KEVCVE-2025-0108HIGHPAN-OS: Authentication Bypass in the Management Web InterfaceEPSS 98.5%KEVCVE-2026-0257HIGHPAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesEPSS 95.6%KEV