PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface (CVE-2025-0111)

What is affected, what to do

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

The vulnerability is being actively exploited; treat it as a priority. Update Palo Alto Networks PAN-OS to version 10.1.14-h9, Palo Alto Networks PAN-OS to version 10.2.7-h24, Palo Alto Networks PAN-OS to version 11.1.6-h1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Palo Alto Networks PAN-OS lt 10.1.0..10.1.14-h9
• Palo Alto Networks PAN-OS lt 10.2.0..10.2.7-h24
• Palo Alto Networks PAN-OS lt 11.1.0..11.1.6-h1
• Palo Alto Networks PAN-OS lt 11.2.0..11.2.4-h4

Fixed in

• Palo Alto Networks PAN-OS 10.1.14-h9
• Palo Alto Networks PAN-OS 10.2.7-h24
• Palo Alto Networks PAN-OS 11.1.6-h1
• Palo Alto Networks PAN-OS 11.2.4-h4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Check and lock down management web interface exposure: In Device > Setup > Interfaces > Management (Permitted IP Addresses) and in every Interface Management Profile (Network > Network Profiles), disable HTTPS/HTTP on dataplane interfaces or restrict them to dedicated admin jump hosts. Internet-facing management interfaces come first.
   • Patch: Upgrade to the fixed releases 11.2.4-h4, 11.1.6-h1, 10.2.7-h24 or 10.1.14-h9, or later. Other 10.2.x maintenance trains have their own hotfix levels, so look up the exact version in the vendor advisory. Move 11.0.x devices to a supported train. Cloud NGFW and Prisma Access are not affected.
   • Account for chaining: Public reporting documents this CVE being combined with the authentication bypass CVE-2025-0108 (and CVE-2024-9474), which effectively removes the "authenticated" precondition. Patch both in the same maintenance window.
   • Compromise assessment for exposed devices: If a device was reachable from untrusted networks, capture a tech support file for evidence before rebooting. Then rotate admin passwords, API keys, and any locally stored certificates or secrets that the "nobody" user could have read.
   • Clean up admin accounts: Disable unknown or stale administrator accounts and trim roles with web UI access to the minimum. Any valid low-privilege login is enough to exploit this flaw.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the management interface exclusively in an out-of-band management VLAN. Allow access only from a PAW/jump-host zone, and drop TCP/443 and TCP/4443 to the management IP from all other zones on upstream firewalls/ACLs.
   • IPS/Threat Prevention: Install the latest content update containing the Threat Prevention signatures for CVE-2025-0108/CVE-2025-0111 (per advisory). Where management is reached through interface management profiles, route that traffic through a security policy with a Vulnerability Protection profile attached.
   • Upstream WAF/proxy rule: Block requests to the management interface that contain encoded traversal sequences (%2e%2e, %252e, ..%2f) or that hit /unauth/ paths and then reach into /php/.
   • IAM/least privilege: Enforce admin authentication through a central IdP with MFA (SAML/RADIUS). Keep local accounts for break-glass use only and shorten admin session timeouts.
   • Configuration hardening: Do not host GlobalProtect portals or gateways on interfaces that also carry a management profile. Disable Telnet/HTTP globally and validate the result against Palo Alto's "Best Practices for Securing Administrative Access".
3. 03

   Runbook step 3

   Detection rules

   • Management web server logs (tech support file or syslog forwarding): Hunt for double-encoded traversal in URIs, e.g. SPL: index=panos sourcetype=pan:* (uri="*%252e%252e*" OR uri="*/unauth/*/php/*").
   • Network telemetry (Zeek/Suricata): Alert on HTTP(S) sessions to the management IP from sources outside the admin zone. Zeek approach: conn.log where id.resp_h in mgmt_ips and id.resp_p in {443,4443} and not id.orig_h in admin_nets.
   • PAN-OS system/config logs: Review admin logins from unknown source IPs or at unusual hours, as well as failed logins followed by a success. A Sigma rule with logsource: product: paloalto, service: system should match eventid: auth-success and negate a source-IP allowlist.
   • Threat log: Treat any hit on the Threat Prevention signatures for CVE-2025-0108/0111 as a confirmed exploitation attempt. KQL (CommonSecurityLog): CommonSecurityLog | where DeviceVendor=="Palo Alto Networks" and Activity=="THREAT" and Message has_any ("CVE-2025-0108","CVE-2025-0111").
   • Follow-on activity: Correlate config commits, new admin accounts, or API key generation that occur shortly after suspicious management-plane access.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Palo Alto Networks Pan-os
• Palo Alto Networks Palo Alto Networks PAN-OS

Weakness classes (CWE)

• CWE-73External Control of File Name or Path

  Base

  The product allows user input to control or influence paths or file names that are used in filesystem operations.

  Entry at MITRE CWE-73

References & sources

• security.paloaltonetworks.comPalo Alto Networks advisory: Palo Alto Networks PAN-OSVendor advisory, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0111government-resource, US government resource
• pwn.watchpwn.watch: Palo Alto Networks PAN-OS: PAN-OS File Read Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-0111pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch