Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality
What happened
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
CISA lists it as exploited, added 18 Feb 2025.
Does it affect you
Names Palo Alto Networks PAN-OS. Enter the product and version you run to place it against the affected range the vendor published.
What to do
- Follow the vendor advisory for the fixed release and any interim mitigation.
security.paloaltonetworks.com - Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
cisa.gov
CISA’s notes for this entry:
Affected, as published to NVD
- panos
- Palo Alto Networks PAN-OS: exactly 10.1.14
The record
- NVD status
- Analyzed
- Published
- 12 Feb 2025, last modified 24 Sep 2026 (NVD)
- Severity
- CVSS 3.1 base score 9.1, Critical — computed here from the vector; NVD states 9.1.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-306 Missing Authentication for Critical Function (NVD; names by MITRE)
- Exploitation
- Listed in CISA’s Known Exploited Vulnerabilities catalogue since 18 Feb 2025; federal remediation due 11 Mar 2025. CISA entry
- Vendor
- Palo Alto Networks · PAN-OS (CISA)
References on the NVD record
- security.paloaltonetworks.com/CVE-2025-0108ExploitVendor Advisory
- github.com/iSee857/CVE-2025-0108-PoCExploitThird Party Advisory
- bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/Press/Media CoverageThird Party Advisory
- darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wildPress/Media CoverageThird Party Advisory
- securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/Press/Media CoverageThird Party Advisory
- theregister.com/2025/02/19/palo_alto_firewall_attack/Press/Media CoverageThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108US Government Resource
- slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/ExploitPress/Media Coverage
Sources
The verdict above is computed from the products and versions you entered and the affected ranges the vendor published to NVD. It does not inspect your environment, and this site never reports a product as unaffected: why.