VulnSocial

CVE-2025-0111Active Exploitation(paloaltonetworks / pan-os)

LOWCVSS 6.5 · MEDIUMCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for paloaltonetworks pan-os systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

paloaltonetworks CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-03-13. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-73CWE-610

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pan-os

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
paloaltonetworks
Products
pan-os

8 versions affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-23: 1Active Exploitation · 2026-03-23: 103-23
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Ed Targett@editortargett
    Active Exploitation

    @IceSolst I give you CVE-2025-0108, CVE-2025-0111 and... but yeah. ditto Check Point. Just six CVEs on KEV. (PAN, 13; Fortinet, 14; Cisco... 87 ;) . Some firms have pretty brutal responsible disclosure small print too, right? https://www.thestack.technology/when-irresponsible-disclosure-becomes-the-only-responsible-option/#responsible-disclosure-silence-by-design

    Post summary

    The tweet references six CVEs that are on the KEV list, indicating active exploitation, but provides no PoC, exploit code, patch, or technical details.

    020511.6K
    1.9K followersView on X
CPE platform detail44 entries

44 of 44 entries

PartVendorProductVersionTarget SWTarget HW
OSpaloaltonetworkspan-os---
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.1.14--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.12--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.13--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.7--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.8--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os10.2.9--
OSpaloaltonetworkspan-os11.1.6--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--
OSpaloaltonetworkspan-os11.2.4--

Explore more

Back to dashboardpaloaltonetworks CVEspan-os vulnerabilities