CVE-2025-0108

UNKNOWN 0.0

⚠️ CISA KEV

PAN-OS: Authentication Bypass in the Management Web Interface

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

CWE	CWE-306
Vendor	palo alto networks
Product	cloud ngfw
Published	Feb 12, 2025
Last Updated	Feb 26, 2026

⚠️ Actively Exploited — Act Now

Get instant alerts for palo alto networks cloud ngfw

This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2025-0108.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Palo Alto Networks / Cloud NGFW

All versions affected

Palo Alto Networks / PAN-OS

10.1.0 < 10.1.14-h9 10.2.0 < 10.2.7-h24 11.1.0 < 11.1.6-h1 11.2.0 < 11.2.4-h4

Palo Alto Networks / Prisma Access

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

security.paloaltonetworks.com: https://security.paloaltonetworks.com/CVE-2025-0108 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108 github.com: https://github.com/iSee857/CVE-2025-0108-PoC theregister.com: https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/ slcyber.io: https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/ darkreading.com: https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild securityweek.com: https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/ bleepingcomputer.com: https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/

Credits

Adam Kues - Assetnote Security Research Team our Deep Product Security Research Team