CVE-2025-0108

Name: CVE-2025-0108
Creator: NVD / NIST
Published: 2025-02-12T21:15:16.29+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10Actively ExploitedEPSS 98.34%

Last modified Jun 17, 2026

CVE-2025-0108 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.. CISA has confirmed active exploitation in the wild. EPSS estimates a 98.34% chance of exploitation in the next 30 days.

Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Metrics

CVSS 3.1

9.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS 4.0

8.8/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red

EPSS Probability

98.34%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Mar 11, 2025.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Paloaltonetworks	Pan-Os	>= 10.1.0, < 10.1.14
Paloaltonetworks	Pan-Os	>= 10.2.0, < 10.2.7
Paloaltonetworks	Pan-Os	>= 11.1.0, < 11.1.2
Paloaltonetworks	Pan-Os	>= 11.2.0, < 11.2.4
Paloaltonetworks	Pan-Os	10.1.14
Paloaltonetworks	Pan-Os	10.2.7
Paloaltonetworks	Pan-Os	10.2.8
Paloaltonetworks	Pan-Os	10.2.9
Paloaltonetworks	Pan-Os	10.2.10
Paloaltonetworks	Pan-Os	10.2.11
Paloaltonetworks	Pan-Os	10.2.12
Paloaltonetworks	Pan-Os	10.2.13
Paloaltonetworks	Pan-Os	11.1.2
Paloaltonetworks	Pan-Os	11.1.3
Paloaltonetworks	Pan-Os	11.1.4
Paloaltonetworks	Pan-Os	11.1.5
Paloaltonetworks	Pan-Os	11.1.6
Paloaltonetworks	Pan-Os	11.2.4

References

https://security.paloaltonetworks.com/CVE-2025-0108Exploit, Vendor Advisory
https://github.com/iSee857/CVE-2025-0108-PoCExploit, Third Party Advisory
https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/Exploit, Press/Media Coverage
https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/Press/Media Coverage, Third Party Advisory
https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wildPress/Media Coverage, Third Party Advisory
https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/Press/Media Coverage, Third Party Advisory
https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/Press/Media Coverage, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108US Government Resource

Timeline

Published: Feb 12, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-0108?

How severe is CVE-2025-0108?

CVE-2025-0108 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 98.34% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2025-0108?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-0108?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST