Palo Alto Networks PAN-OS Management Web Interface Authentication Bypass Vulnerability (CVE-2025-0108) Emergency Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTPalo Alto Networks PAN-OS software management web interface (excluding Cloud NGFW and Prisma Access)
Unauthenticated remote attackers with network access can bypass authentication on the management interface and invoke sensitive PHP scripts, severely compromising system integrity and confidentiality
Immediately upgrade to the patched PAN-OS versions and restrict access to the management interface to trusted internal IP addresses only
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates provided by Palo Alto Networks immediately. Use the following CLI commands to perform the upgrade:
# Retrieve the latest software information and available images
request system software info
# Download the secure patched PAN-OS version (e.g., safe 10.1.x, 11.x releases)
request system software download version <target_safe_version>
# Install the downloaded software package
request system software install version <target_safe_version>
# Reboot the system to apply the patch
request restart system2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the management web interface to trusted internal IP addresses only.
# Enter configuration mode on PAN-OS CLI
configure
# Restrict management access to a trusted administrator subnet (e.g., 192.168.10.0/24)
set deviceconfig system permitted-ip 192.168.10.0/24
# Commit the changes to apply the access control list (ACL)
commit
exit3. Log Audit & IoC Verification Commands
Inspect system logs for potential exploitation attempts or unauthorized access to PHP scripts using the following commands:
# Search system logs for suspicious PHP script invocations or path manipulation patterns
show log system direction equal backward | match '(?i)(/php/|\.php)'
# Verify the current running PAN-OS version to confirm vulnerability status
show system info | match 'sw-version'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-0108) is a critical authentication bypass vulnerability in the management web interface of Palo Alto Networks PAN-OS. The root cause lies in a path confusion discrepancy between the front-end Nginx reverse proxy and the back-end Apache/PHP web server. Due to missing proper authentication enforcement (CWE-306) on specific endpoints, unauthenticated attackers can directly access restricted PHP scripts.
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to the PAN-OS management web interface crafts a malicious HTTP request designed to exploit the URI parsing differences between Nginx and Apache. While Nginx processes the request as an unauthenticated public resource, the back-end Apache server routes and executes it as an internal administrative PHP script. This allows the attacker to invoke backend functions and retrieve sensitive configuration data without any valid session credentials.
3. Infrastructure & Business Impact
With a CVSS score of 9.1 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability is actively being exploited in the wild. Although it does not directly grant remote code execution (RCE) out-of-the-box, successful exploitation can lead to complete exposure of firewall configurations, session hijacking, and unauthorized administrative actions, posing a severe threat to the entire enterprise network perimeter.
Official Vendor Advisories & References
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
Frequently Asked SecOps Questions (CVE-2025-0108)
FAQQ1. How critical is CVE-2025-0108 and is it actively exploited in the wild?
CVE-2025-0108 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 98.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-0108?
Primary impacted vendors include paloaltonetworks across pan-os. Scope summary: All PAN-OS software versions with the management web interface enabled (Cloud NGFW and Prisma Access are not affected)
Q3. What temporary mitigations or workarounds exist for CVE-2025-0108 before patching?
[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict access to the management interface to trusted internal IP addresses only Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-0108
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paloaltonetworks)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).
Palo Alto Networks PAN-OS Management Interface Remote Code Execution (RCE) Vulnerability (CVE-2026-0322)
[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS
TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.