Palo Alto Networks PAN-OS File Read Vulnerability
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to
What happened
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
CISA lists it as exploited, added 20 Feb 2025.
Does it affect you
Names Palo Alto Networks PAN-OS. Enter the product and version you run to place it against the affected range the vendor published.
What to do
- Follow the vendor advisory for the fixed release and any interim mitigation.
security.paloaltonetworks.com - Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
cisa.gov
CISA’s notes for this entry:
Affected, as published to NVD
- panos
- Palo Alto Networks PAN-OS: exactly 10.1.14
The record
- NVD status
- Analyzed
- Published
- 12 Feb 2025, last modified 17 Jun 2026 (NVD)
- Severity
- CVSS 3.1 base score 6.5, Medium — computed here from the vector; NVD states 6.5.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-73 External Control of File Name or Path, CWE-610 Externally Controlled Reference to a Resource in Another Sphere (NVD; names by MITRE)
- Exploitation
- Listed in CISA’s Known Exploited Vulnerabilities catalogue since 20 Feb 2025; federal remediation due 13 Mar 2025. CISA entry
- Vendor
- Palo Alto Networks · PAN-OS (CISA)
References on the NVD record
- security.paloaltonetworks.com/CVE-2025-0111Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0111US Government Resource
Sources
The verdict above is computed from the products and versions you entered and the affected ranges the vendor published to NVD. It does not inspect your environment, and this site never reports a product as unaffected: why.