CVE-2025-4615

HighCVSS 7.2/10Last modified Oct 18, 2026

Description

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-83

Affected software

Vendor	Product	Versions
Palo Alto Networks	Cloud NGFW	—
Palo Alto Networks	PAN-OS	>= 11.2.0, < 11.2.8; >= 11.1.0, < 11.1.4-h27; >= 10.2.0, < 10.2.17
Palo Alto Networks	Prisma Access	—

References

https://security.paloaltonetworks.com/CVEN-2025-4615Vendor Advisory

Timeline

Published: Oct 9, 2025
Last modified: Oct 18, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-461505.3In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.CVE-2025-461525.3In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument.CVE-2025-461535.3PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU impl CVE-2025-461548.4Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php.CVE-2025-461579.9An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave reques CVE-2025-461586.2An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the `setitimer` syscall CVE-2025-46161.1An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admi CVE-2025-46171.1An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin u CVE-2025-461715.4vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a suffic CVE-2025-461736.1code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.CVE-2025-461747.5Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUse CVE-2025-461757.5Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of Sys