CVE-2025-0108

CriticalCVSS 9.1/10Known exploited (CISA KEV)Last modified Sep 24, 2026

Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Feb 12, 2025
Last modified
Sep 24, 2026
Added to CISA KEV
Feb 18, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-01096.9An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attackerCVE-2025-01108.6A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the abilityCVE-2025-01116.5An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to CVE-2025-01126.8A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrCVE-2025-01135.3A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to DockerCVE-2025-01147.5A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attackCVE-2025-01156.8A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attCVE-2025-01166.8A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a sCVE-2025-01177.1A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticateCVE-2025-01188.0A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context oCVE-2025-01196.3A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commaCVE-2025-01207.0A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authe
CVE-2025-0108: Critical severity, CVSS 9.1 | Vulnix