PAN-OS: Authentication Bypass in the Management Web Interface (CVE-2025-0108)

What is affected, what to do

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

The vulnerability is being actively exploited; treat it as a priority. Update Palo Alto Networks PAN-OS to version 10.1.14-h9, Palo Alto Networks PAN-OS to version 10.2.7-h24, Palo Alto Networks PAN-OS to version 11.1.6-h1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Palo Alto Networks PAN-OS lt 10.1.0..10.1.14-h9
• Palo Alto Networks PAN-OS lt 10.2.0..10.2.7-h24
• Palo Alto Networks PAN-OS lt 11.1.0..11.1.6-h1
• Palo Alto Networks PAN-OS lt 11.2.0..11.2.4-h4

Fixed in

• Palo Alto Networks PAN-OS 10.1.14-h9
• Palo Alto Networks PAN-OS 10.2.7-h24
• Palo Alto Networks PAN-OS 11.1.6-h1
• Palo Alto Networks PAN-OS 11.2.4-h4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Establish exposure now: Inventory every PAN-OS device and check whether the management web interface (HTTPS, by default TCP 443 on the MGT port or via an Interface Management Profile on dataplane interfaces) is reachable from the internet or untrusted segments. Cross-check with Shodan/Censys or your own external scan of public ranges.
   • Patch: Upgrade to a fixed release. Per the context these include PAN-OS 11.2.4-h4, 11.1.6-h1, 10.2.7-h24 and 10.1.14-h9. For other maintenance trains (e.g. other 10.2.x or 11.1.x releases), look up the matching hotfix in the vendor advisory for CVE-2025-0108. Cloud NGFW and Prisma Access are not affected.
   • Lock down management access if you cannot patch today: Restrict the web UI to a defined admin jump-host list or management VLAN (Device > Setup > Interfaces > Management > Permitted IP Addresses). Disable HTTPS in every Interface Management Profile bound to externally reachable interfaces — including interfaces hosting a GlobalProtect portal/gateway.
   • Hunt for compromise: For any device whose management UI was exposed, pull a tech-support file and review the management web-server logs for the patterns below. This bug is known to be chained with other PAN-OS flaws (privilege escalation, arbitrary file read) — the auth bypass is usually just the foothold.
   • Rotate credentials on suspicion: If you find access traces, rotate local admin accounts, API keys and stored secrets (LDAP/RADIUS bind, IPsec PSKs, certificate private keys). Diff the running config against a known-good Panorama backup.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Run management interfaces only on an out-of-band management network, reachable solely through PAM-brokered jump hosts. Add upstream ACLs/perimeter rules dropping internet traffic to TCP 443 on management IPs as a second layer.
   • IPS/Threat Prevention: Install the latest Threat Prevention content and check whether the vendor ships threat IDs for CVE-2025-0108 (look up the IDs in the vendor advisory). These only help when management traffic traverses a dataplane interface with a security policy and Vulnerability Protection profile — they do not cover the dedicated MGT port.
   • Upstream filtering (if a reverse proxy/IPS sits in front): Block requests to management IPs whose URI contains double-URL-encoded traversal sequences (%252e%252e, %252f) or paths under /unauth/ combined with /php/.
   • Configuration hardening: Remove unneeded Interface Management Profiles, especially on untrust zones. Disable Telnet/HTTP entirely; permit only HTTPS/SSH from the permitted-IP list.
   • IAM/least privilege: Trim admin roles to the minimum, enforce MFA for administrative logins (SAML/RADIUS) and monitor config changes via Panorama commit auditing.
3. 03

   Runbook step 3

   Detection rules

   • Management web-server logs (from tech-support file, e.g. nginx/httpd access logs): Look for requests containing /unauth/ followed by %252e%252e or %2e%2e and a target under /php/, typically with a trailing .css/.js suffix to slip past path checks. Sigma shape: cs-uri-stem|contains: '/unauth/' AND cs-uri-stem|contains: '%252e%252e' AND cs-uri-stem|contains: '/php/'.
   • Zeek/Suricata on the management segment: HTTP requests with double-encoded traversal against firewall management IPs. SPL: index=zeek sourcetype=zeek_http dest_ip IN (<mgmt_ips>) uri="*%252e%252e*" uri="*/php/*" | stats count by src_ip, uri.
   • PAN-OS system/config logs: Unexpected admin logins, newly created admin accounts, config changes or commits outside change windows — especially from source IPs outside the permitted list. KQL (syslog forwarded to Sentinel): CommonSecurityLog | where DeviceVendor=="Palo Alto Networks" and Activity in ("SYSTEM","CONFIG") and SourceIP !in (allowed_admin_ips).
   • Threat log: Raise hits on vendor signatures for CVE-2025-0108 and related PAN-OS management-plane flaws as high-severity SIEM alerts.
   • Network baseline: Alert on new outbound connections from the firewall management interface to unfamiliar external destinations (possible exfiltration after a successful chain).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Palo Alto Networks Pan-os
• Palo Alto Networks Palo Alto Networks PAN-OS

Weakness classes (CWE)

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• security.paloaltonetworks.comPalo Alto Networks advisory: Palo Alto Networks PAN-OSVendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108government-resource
• github.comiSee857/CVE-2025-0108-PoC
• theregister.com2025/02/19/palo_alto_firewall_attack
• slcyber.ioblog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os
• darkreading.comremote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw…
• securityweek.compalo-alto-networks-confirms-exploitation-of-firewall-vulnerabil…
• bleepingcomputer.comnews/security/palo-alto-networks-tags-new-firewall-bug-as-explo…
• pwn.watchpwn.watch: Palo Alto Networks PAN-OS: PAN-OS Authentication Bypass Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-0108pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Translated24.09.2026nvd@nist.gov

   • Translation: before Title: PAN-OS de Palo Alto Networks, Description: Una omisión de autenticación en el software PAN-OS de Palo Alto Networks permite que un atacante no autenticado con acceso a la red a la interfaz web de administración omita la autenticación que de otro modo requeriría la interfaz web de administración de PAN-OS e invoque ciertos scripts PHP. Si bien la invocación de estos scripts PHP no permite la ejecución remota de código, puede afectar negativamente la integridad y la confidencialidad de PAN-OS. Puede reducir en gran medida el riesgo de este problema al restringir el acceso a la interfaz web de administración solo a direcciones IP internas confiables de acuerdo con nuestras pautas de implementación de mejores prácticas recomendadas https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Este problema no afecta al software Cloud NGFW ni a Prisma Access. after Title: PAN-OS de Palo Alto Networks, Description: Una omisión de autenticación en el software PAN-OS de Palo Alto Networks permite que un atacante no autenticado con acceso a la red a la interfaz web de administración omita la autenticación que de otro modo requeriría la interfaz web de administración de PAN-OS e invoque ciertos scripts PHP. Si bien la invocación de estos scripts PHP no permite la ejecución remota de código, puede afectar negativamente la integridad y la confidencialidad de PAN-OS. Puede reducir en gran medida el riesgo de este problema al restringir el acceso a la interfaz web de administración solo a direcciones IP internas confiables de acuerdo con nuestras pautas de implementación de mejores prácticas recomendadas https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Este problema no afecta al software Cloud NGFW ni a Prisma Access.