CVE-2025-0108 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-02-12

Added to CISA KEV: 2025-02-18 6 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
IMMEDIATE: Restrict management interface access to trusted internal IP addresses only per vendor best practices
URGENT: Apply vendor patches immediately - multiple hotfixes available across PAN-OS versions 10.1, 10.2, 11.1, and 11.2
Deploy Threat Prevention signatures (Threat ID 510000 and 510001) if available
Monitor management interface access logs for suspicious activity
Verify no unauthorized configuration changes or administrative access
Patch priority: CRITICAL - Active exploitation targeting internet-facing management interfaces

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-0108 is a critical authentication bypass vulnerability affecting Palo Alto Networks PAN-OS software ^[1].

Overview and Impact

Vulnerability Type: Authentication bypass in the management web interface ^[3].
Impact: Successful exploitation allows an unauthenticated attacker to bypass authentication requirements and invoke specific PHP scripts on the affected device ^[4].
Exploitation Context: Palo Alto Networks has observed this vulnerability being used in active, chained attacks against unpatched and unsecured PAN-OS web management interfaces ^[1].

Attack Method and Requirements

Network vs. Local: The attack is network-based; it requires the attacker to have network access to the management web interface ^[3].
User Interaction: No user interaction is required for a successful exploit ^[5].
Chained Exploitation: Threat actors have been observed chaining CVE-2025-0108 with other vulnerabilities—specifically CVE-2024-9474 (a privilege escalation flaw) and CVE-2025-0111 (an authenticated file read vulnerability)—to gain unauthorized access and breach PAN-OS firewalls ^[2].

Mitigation and Status

Patch Status: Users are advised to refer to the official Palo Alto Networks security advisory for specific patch information and to apply updates as part of their regular maintenance cycle ^[1].
Immediate Mitigation: Palo Alto Networks recommends significantly reducing the risk of exploitation by restricting access to the management interface. Ideally, access should be limited to a dedicated, secure jump box, ensuring that only authorized systems can reach the interface ^[1].

Sources

CVE-2025-0108 PAN-OS: Authentication Bypass in the ...
Palo Alto Networks Security Advisory: CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface An authentication bypass ... Exploitation Status Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured P…
CVE-2025-25067 | CyberSecurityBoard
Palo Alto Networks tags new firewall bug as exploited in attacks - Palo Alto Networks warns that a file read vulnerability (CVE-2025-0111) is now being chained in attacks with two other flaws (CVE-2025-0108 with CVE-2024-9474) to breach PAN-OS firewalls in active attacks. ... attackers making exploi…
CVE‑2025‑0108 Detail - NVD
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface.
NVD - CVE-2025-0108
CVE-2025-0108 Detail Description An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP sc…
CVE-2025-0108 - Vulnerability Details - OpenCVE
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected). ... Attack Requirements Present. User Interaction None. Vulnerable System Confidentiality Impact High.chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and u…