{"id":"CVE-2025-0108","published":"2025-02-12T21:15:16Z","modified":"2026-09-24T13:10:00Z","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","vendor":"Palo Alto Networks","product":"PAN-OS","tier":"core","eol":null,"description":{"text":"An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.\n\nYou can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue does not affect Cloud NGFW or Prisma Access software.","provenance":"source","from":"NVD"},"summary":{"text":"A missing-authentication flaw in the management web interface of Palo Alto Networks PAN-OS lets an attacker bypass the authentication normally required to reach certain PHP scripts. An unauthenticated attacker with network access to that management interface can invoke these scripts, which can affect the integrity and confidentiality of PAN-OS, though the flaw does not enable remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:26Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.98141,"percentile":0.99913,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-02-18","dueDate":"2025-03-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://security.paloaltonetworks.com/CVE-2025-0108 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0108","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-13","exploitedFirstSeen":"2025-02-13","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-13&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-13"},{"url":"https://www.greynoise.io/blog/greynoise-observes-active-exploitation-of-pan-os-authentication-bypass-vulnerability-cve-2025-0108","date":"2025-02-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-14&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-15&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-16&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-17&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-17"},{"url":"https://security.paloaltonetworks.com/CVE-2025-0108","date":"2025-02-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-19&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-20&host_type=src&vulnerability=cve-2025-0108","date":"2025-02-20"}],"evidenceTotal":603,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2025-0108","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/iSee857/CVE-2025-0108-PoC","tags":["Exploit","Third Party Advisory"]},{"url":"https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This exploit is part of a chain of exploits (with CVE-2025-0108 and CVE-2024-9474) that can end with an attacker gaining root access to the system. This vulnerability allows the attacker to bypass authentication using the PAN-OS web management interface, as well as invoke PHP scripts. The attacker can also use their newfound privileged access to reconfigure the firewall, allowing for backdoors to be created.","confidence":"high"},{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This exploit is part of a chain of exploits (with CVE-2025-0108 and CVE-2024-9474) that can end with an attacker gaining root access to the system. This vulnerability allows the attacker to bypass authentication using the PAN-OS web management interface, as well as invoke PHP scripts. The attacker can also use their newfound privileged access to reconfigure the firewall, allowing for backdoors to be created.","confidence":"high"},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This exploit is part of a chain of exploits (with CVE-2025-0108 and CVE-2024-9474) that can end with an attacker gaining root access to the system. This vulnerability allows the attacker to bypass authentication using the PAN-OS web management interface, as well as invoke PHP scripts. The attacker can also use their newfound privileged access to reconfigure the firewall, allowing for backdoors to be created.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-1505","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1505","exploited":true,"exploitedSince":"2025-02-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":2,"earliest":"2025-02-13","earliestUrl":"https://github.com/iSee857/CVE-2025-0108-PoC","repos":[{"name":"iSee857/CVE-2025-0108-PoC","url":"https://github.com/iSee857/CVE-2025-0108-PoC","stars":33,"created":"2025-02-13"},{"name":"FOLKS-iwd/CVE-2025-0108-PoC","url":"https://github.com/FOLKS-iwd/CVE-2025-0108-PoC","stars":8,"created":"2025-02-14"},{"name":"fr4nc1stein/CVE-2025-0108-SCAN","url":"https://github.com/fr4nc1stein/CVE-2025-0108-SCAN","stars":2,"created":"2025-02-18"},{"name":"becrevex/CVE-2025-0108","url":"https://github.com/becrevex/CVE-2025-0108","stars":2,"created":"2025-02-19"},{"name":"sohaibeb/CVE-2025-0108","url":"https://github.com/sohaibeb/CVE-2025-0108","stars":1,"created":"2025-02-19"}]},"nuclei":[{"id":"CVE-2025-0108","name":"PAN-OS Management Interface - Path Confusion to Authentication Bypass","severity":"critical","path":"http/cves/2025/CVE-2025-0108.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0108.yaml"}],"first":{"date":"2025-02-13","source":"PoC-in-GitHub","url":"https://github.com/iSee857/CVE-2025-0108-PoC"},"provenance":"source"},"exploitRefs":["https://security.paloaltonetworks.com/CVE-2025-0108","https://github.com/iSee857/CVE-2025-0108-PoC","https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1055","T1565.001"],"provenance":"source"}],"timeline":[{"date":"2025-02-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0108","provenance":"source"},{"date":"2025-02-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/iSee857/CVE-2025-0108-PoC","provenance":"source"},{"date":"2025-02-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-13&host_type=src&vulnerability=cve-2025-0108","provenance":"source"},{"date":"2025-02-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1505","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":6},"priority":{"score":69.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 625 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}