CVE-2025-0108highunder attackCWE-306

CVE-2025-0108: high-severity vulnerability in Palo Alto Networks PAN-OS

PAN-OS: Authentication Bypass in the Management Web Interface

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 98%
from disclosure to weapon1 days
Published on NVDFeb 12
1st PoC+1d
CISA KEV+6d
exploitation probability
98%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
13 public exploit(s)
Action required by CISAfederal deadline: 2025-03-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An attacker can bypass the login authentication on PAN-OS management interface without credentials, allowing unauthorized access to certain functions that could compromise data security and system integrity.

Technical detail

An unauthenticated attacker with network access to the management web interface can bypass authentication via a PHP script invocation vector (CWE-306), enabling unauthorized access to sensitive operations that impact confidentiality and integrity, though not enabling remote code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red
Affected products
Palo Alto Networks · Cloud NGFWPalo Alto Networks · PAN-OSPalo Alto Networks · Prisma Access
public PoCs found — 13
githubgithub.com/iSee857/CVE-2025-0108-PoC★ 32githubgithub.com/FOLKS-iwd/CVE-2025-0108-PoC★ 8githubgithub.com/becrevex/CVE-2025-0108★ 2githubgithub.com/fr4nc1stein/CVE-2025-0108-SCAN★ 2githubgithub.com/sohaibeb/CVE-2025-0108★ 1githubgithub.com/kso4more/CVE-2025-0108★ 0githubgithub.com/barcrange/CVE-2025-0108-Authentication-Bypass-checker★ 0vulncheckvulncheck.com/xdb/81f131d1f00dunverifiedvulncheckvulncheck.com/xdb/f70f1cc5b204unverifiedvulncheckvulncheck.com/xdb/b12dbc5cd9c9unverifiedvulncheckvulncheck.com/xdb/e534e54d74a7unverifiedvulncheckvulncheck.com/xdb/1b50d3d89443unverifiedvulncheckvulncheck.com/xdb/c7b1b239539dunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Palo Alto Networks PAN-OS

In the same product, most dangerous first.

CVE-2024-3400CRITICALPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectEPSS 100.0%KEVCVE-2024-0012CRITICALPAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)EPSS 99.9%KEVCVE-2026-0257HIGHPAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesEPSS 96.9%KEVCVE-2024-9474MEDIUMPAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceEPSS 94.8%KEVCVE-2026-0300CRITICALPAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalEPSS 31.7%KEVCVE-2024-3393HIGHPAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted PacketEPSS 29.1%KEV
References
https://github.com/iSee857/CVE-2025-0108-PoChttps://security.paloaltonetworks.com/CVE-2025-0108https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wildhttps://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/