VulnSocial

CVE-2025-0108Active Exploitation(paloaltonetworks / pan-os)

MEDIUMCVSS 9.1 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch paloaltonetworks pan-os systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

paloaltonetworks CVEsBack to dashboard
5.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-03-11. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-306

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pan-os

Threat summary

  • Active exploitation appears in 3 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 5 observed days

What's happening

  • Active exploitation reported across 3 signals
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 4d ago at 1 mentions (2026-01-28); latest day: 1
  • 5 total mentions across 5 days

Affected systems

Vendors
paloaltonetworks
Products
pan-os

14 versions affected across 1 product

Deep dive

Activity timeline5 mentions / 5d
00111Mentions · 2026-01-28: 1Mentions · 2026-03-23: 1Mentions · 2026-03-29: 1Mentions · 2026-05-24: 1Mentions · 2026-06-01: 1PoC Mentioned / Linked · 2026-03-29: 1Active Exploitation · 2026-01-28: 1Active Exploitation · 2026-03-23: 1Active Exploitation · 2026-06-01: 1Patch / Workaround · 2026-06-01: 1Technical Details · 2026-05-24: 1Technical Details · 2026-06-01: 101-2803-2303-2905-2406-01
Signal classification2 categories
Active Exploitation
360.0%
Disclosure
240.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-01-281
Active Exploitation1
2026-03-231
Active Exploitation1
2026-03-291
Disclosure1
2026-05-241
Disclosure1
2026-06-011
Active Exploitation1
Full discourse5 posts
  • shakquraa@shakquraa
    Disclosure

    Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108) 💀 https://www.assetnote.io/resources/research/nginx-apache-path-confusion-to-auth-bypass-in-pan-os https://t.co/QaFFWLpwnH

    Post summary

    The tweet announces the PAN-OS authentication bypass vulnerability (CVE-2025-0108) and links to a research article, but it does not provide exploit code, patch details, or evidence of active exploitation.

    117091535.6K
    2.2K followersView on X
  • Ed Targett@editortargett
    Active Exploitation

    @IceSolst I give you CVE-2025-0108, CVE-2025-0111 and... but yeah. ditto Check Point. Just six CVEs on KEV. (PAN, 13; Fortinet, 14; Cisco... 87 ;) . Some firms have pretty brutal responsible disclosure small print too, right? https://www.thestack.technology/when-irresponsible-disclosure-becomes-the-only-responsible-option/#responsible-disclosure-silence-by-design

    Post summary

    The tweet references six CVEs that are on the KEV list, implying they are being actively exploited in the wild, yet it provides no technical details, PoC, or patch information.

    020511.6K
    1.9K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Palo Alto Networks, Authentication Bypass, #CVE-2025-0108 (Critical) https://dailycve.com/palo-alto-networks-authentication-bypass-cve-2025-0108-critical/

    Post summary

    A new critical authentication bypass vulnerability (CVE-2025-0108) has been disclosed by Palo Alto Networks, but the excerpt contains no PoC, exploit, or patch details.

    01010429
    220 followersView on X
  • Rory J Bernier@RoryCrave
    Active Exploitation

    🚨 Palo Alto Networks has reported ~500 vulnerabilities to date The pattern is concerning: • CVE-2024-3400: Zero-day exploited BEFORE patches • 2,000+ firewalls compromised via CVE-2024-0012/9474 • CVE-2025-0108: Exploited within 24 HOURS of disclosure Even "enterprise-grade" security has gaps. Defense in depth isn't optional. #CyberSecurity #InfoSec #ZeroDay

    Post summary

    The post highlights that Palo Alto CVEs—including CVE-2024-3400, CVE-2024-0012/9474, and CVE-2025-0108—have already been exploited in the wild, compromising thousands of firewalls before patches were available.

    10000191
    3.0K followersView on X
  • JTCrawford@JtCrawford
    Active Exploitation

    The Palo Alto VPN auth bypass is getting exploited in the wild. If you're running PAN-OS, you're patching this weekend. CVE-2025-0108 lets attackers skip authentication entirely—no credentials needed. Supply chain dominance meets single point of failure. #InfoSec #ZeroTrust

    Post summary

    CVE-2025-0108, a Palo Alto VPN authentication bypass, is actively being exploited in the wild and a PAN‑OS patch is imminent to mitigate the risk.

    0000044
    48 followersView on X
CPE platform detail148 entries

148 of 148 entries

PartVendorProductVersionTarget SWTarget HW
OSpaloaltonetworkspan-os---
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.10--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.11--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.2--
OSpaloaltonetworkspan-os11.1.3--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.4--
OSpaloaltonetworkspan-os11.1.5--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--

Explore more

Back to dashboardpaloaltonetworks CVEspan-os vulnerabilities