ZeroDay Findings
Sign inSign up

Findings

CVE-2025-0108

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Published Feb 12, 2025 · updated Sep 24, 2026 · paloaltonetworks pan-os

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 12, 2025 · Catalog

    Detected

    An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality

  2. Feb 18, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Mar 11, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Sep 24, 2026 · Catalog

    Updated

    An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Mar 11, 2025

Affected

  • cpe paloaltonetworks/pan-osversion unspecified
  • cpe paloaltonetworks/pan-os10.1.14
  • vendor Palo Alto Networks PAN-OSversion unspecified

Sources

  • CISA KEVCVE-2025-0108

    Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.

    cisa.gov
  • CVE.orgCVE-2025-0108

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-0108

    30-day exploitation probability 98.5%

    first.org
  • NIST NVDCVE-2025-0108

    An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While

    nvd.nist.gov

References

CVE-2025-0108 · ZeroDay Findings