Back to CVE Browser

CVE-2025-0108

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-02-12

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Affected Platforms (CPE)

💻

Paloaltonetworks

Pan Os

>= 10.1.0 and < 10.1.14>= 10.2.0 and < 10.2.7>= 11.1.0 and < 11.1.2>= 11.2.0 and < 11.2.4= 10.1.14= 10.2.7= 10.2.8= 10.2.9= 10.2.10= 10.2.11= 10.2.12= 10.2.13= 11.1.2= 11.1.3= 11.1.4= 11.1.5= 11.1.6= 11.2.4

References & Advisories

🔗 https://security.paloaltonetworks.com/CVE-2025-0108

🔗 https://github.com/iSee857/CVE-2025-0108-PoC

🔗 https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/

🔗 https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/

🔗 https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild

🔗 https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/

🔗 https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108

Related Security Intelligence Articles

Weekly Cybersecurity News: Jul 27, 2026

Weekly cybersecurity news covering active exploitation of Check Point SmartConsole CVE-2026-16232, Qilin ransomware leveraging PAN-OS GlobalProtect vulnerabilities, Russian LAUNDRY BEAR targeting Zimbra email servers, and FakeGit malicious repositories.

Global Cyber Intel Digest: July 22, 2026

Coverage of active exploitation targeting on-premise Microsoft SharePoint CVE-2026-50522, Qilin ransomware leveraging PAN-OS CVE-2026-0257 GlobalProtect authentication bypass, and critical security patch updates across enterprise networking hardware.

Related Vulnerabilities

CVE-2026-643787.8

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and ino...

CVE-2026-638137.8

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache i...

CVE-2026-02877.5

Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network a...

CVE-2026-02867.2

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administ...