Critical severity9.1CISA KEVNVD Advisory· Published Feb 12, 2025· Updated Jun 17, 2026

CVE-2025-0108

Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

152

Paloaltonetworks/Pan OS149 versions
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*+ 148 more
- cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*range: >=10.1.0,<10.1.14
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h20:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h20:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*
- (no CPE)
Paloaltonetworks/PAN-OS management web interfacellm-create
Paloaltonetworks/Cloud Ngfwcpe-rescue
Range: All
Paloaltonetworks/Prisma Access Agentcpe-rescue
Range: All

Patches

Vulnerability mechanics

References

security.paloaltonetworks.com/CVE-2025-0108nvdExploitVendor Advisory
slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/nvdExploitPress/Media Coverage
www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/nvdPress/Media CoverageThird Party Advisory
www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wildnvdPress/Media CoverageThird Party Advisory
www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/nvdPress/Media CoverageThird Party Advisory
www.theregister.com/2025/02/19/palo_alto_firewall_attack/nvdPress/Media CoverageThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit
Dark Reading · Jun 1, 2026

Severity

CriticalCVSS v3.1

9.1/ 10

CVSS v48.8

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected

Source repo: github.com/iSee857/CVE-2025-0108-PoC

EPSS

Probability of exploitation in the next 30 days.

98.46%

VYPR risk score

Composite of severity, exploitation, and reach.

0.79high

cvss	0.591
epss	0.079
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000

Weaknesses

CWE-306
Missing Authentication for Critical Function

CVE ID

CVE-2025-0108

Credits

AK
Adam Kues - Assetnote Security Research Team
finder
OD
our Deep Product Security Research Team
finder