CVE-2025-0108: PAN-OS: Authentication Bypass in the Management Web Interface

Published Feb 12, 2025
·
Updated

An authentication bypass in the in the management web interface of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

The attacker must have network access to the management web interface to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).

This issue does not affect Cloud NGFW or Prisma Access software.

Other sources

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.

— MITRE

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.

— CISA

Affected Software

156 affected componentsFixes available
Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS
Palo Alto Networks Cloud NGFW
Palo Alto Networks PAN-OS<10.1.14-h9, =10.1.0, <10.2.7-h24, =10.2.0, <11.1.6-h1, =11.1.0, <11.2.4-h4, =11.2.0
10.1.14-h910.2.7-h2410.2.8-h2110.2.9-h2110.2.12-h610.2.13-h310.2.10-h1410.2.11-h1211.1.6-h111.1.2-h1811.1.4-h1311.2.4-h411.2.5
Palo Alto Networks Prisma Access
Palo Alto Networks PAN-OS>=10.1.0<10.1.14
Palo Alto Networks PAN-OS>=10.2.0<10.2.7
Palo Alto Networks PAN-OS>=11.1.0<11.1.2
Palo Alto Networks PAN-OS>=11.2.0<11.2.4
Palo Alto Networks PAN-OS=10.1.14
Palo Alto Networks PAN-OS=10.1.14-h1
Palo Alto Networks PAN-OS=10.1.14-h2
Palo Alto Networks PAN-OS=10.1.14-h3
Palo Alto Networks PAN-OS=10.1.14-h4
Palo Alto Networks PAN-OS=10.1.14-h5
Palo Alto Networks PAN-OS=10.1.14-h6
Palo Alto Networks PAN-OS=10.1.14-h7
Palo Alto Networks PAN-OS=10.1.14-h8
Palo Alto Networks PAN-OS=10.2.7
Palo Alto Networks PAN-OS=10.2.7-h1
Palo Alto Networks PAN-OS=10.2.7-h10
Palo Alto Networks PAN-OS=10.2.7-h11
Palo Alto Networks PAN-OS=10.2.7-h12
Palo Alto Networks PAN-OS=10.2.7-h13
Palo Alto Networks PAN-OS=10.2.7-h14
Palo Alto Networks PAN-OS=10.2.7-h15
Palo Alto Networks PAN-OS=10.2.7-h16
Palo Alto Networks PAN-OS=10.2.7-h17
Palo Alto Networks PAN-OS=10.2.7-h18
Palo Alto Networks PAN-OS=10.2.7-h19
Palo Alto Networks PAN-OS=10.2.7-h2
Palo Alto Networks PAN-OS=10.2.7-h20
Palo Alto Networks PAN-OS=10.2.7-h21
Palo Alto Networks PAN-OS=10.2.7-h22
Palo Alto Networks PAN-OS=10.2.7-h23
Palo Alto Networks PAN-OS=10.2.7-h3
Palo Alto Networks PAN-OS=10.2.7-h4
Palo Alto Networks PAN-OS=10.2.7-h5
Palo Alto Networks PAN-OS=10.2.7-h6
Palo Alto Networks PAN-OS=10.2.7-h7
Palo Alto Networks PAN-OS=10.2.7-h8
Palo Alto Networks PAN-OS=10.2.7-h9
Palo Alto Networks PAN-OS=10.2.8
Palo Alto Networks PAN-OS=10.2.8-h1
Palo Alto Networks PAN-OS=10.2.8-h10
Palo Alto Networks PAN-OS=10.2.8-h11
Palo Alto Networks PAN-OS=10.2.8-h12
Palo Alto Networks PAN-OS=10.2.8-h13
Palo Alto Networks PAN-OS=10.2.8-h14
Palo Alto Networks PAN-OS=10.2.8-h15
Palo Alto Networks PAN-OS=10.2.8-h16
Palo Alto Networks PAN-OS=10.2.8-h17
Palo Alto Networks PAN-OS=10.2.8-h18
Palo Alto Networks PAN-OS=10.2.8-h19
Palo Alto Networks PAN-OS=10.2.8-h2
Palo Alto Networks PAN-OS=10.2.8-h20
Palo Alto Networks PAN-OS=10.2.8-h3
Palo Alto Networks PAN-OS=10.2.8-h4
Palo Alto Networks PAN-OS=10.2.8-h5
Palo Alto Networks PAN-OS=10.2.8-h6
Palo Alto Networks PAN-OS=10.2.8-h7
Palo Alto Networks PAN-OS=10.2.8-h8
Palo Alto Networks PAN-OS=10.2.8-h9
Palo Alto Networks PAN-OS=10.2.9
Palo Alto Networks PAN-OS=10.2.9-h1
Palo Alto Networks PAN-OS=10.2.9-h11
Palo Alto Networks PAN-OS=10.2.9-h12
Palo Alto Networks PAN-OS=10.2.9-h13
Palo Alto Networks PAN-OS=10.2.9-h14
Palo Alto Networks PAN-OS=10.2.9-h15
Palo Alto Networks PAN-OS=10.2.9-h16
Palo Alto Networks PAN-OS=10.2.9-h17
Palo Alto Networks PAN-OS=10.2.9-h18
Palo Alto Networks PAN-OS=10.2.9-h19
Palo Alto Networks PAN-OS=10.2.9-h2
Palo Alto Networks PAN-OS=10.2.9-h20
Palo Alto Networks PAN-OS=10.2.9-h3
Palo Alto Networks PAN-OS=10.2.9-h4
Palo Alto Networks PAN-OS=10.2.9-h5
Palo Alto Networks PAN-OS=10.2.9-h6
Palo Alto Networks PAN-OS=10.2.9-h7
Palo Alto Networks PAN-OS=10.2.9-h8
Palo Alto Networks PAN-OS=10.2.9-h9
Palo Alto Networks PAN-OS=10.2.10
Palo Alto Networks PAN-OS=10.2.10-h1
Palo Alto Networks PAN-OS=10.2.10-h10
Palo Alto Networks PAN-OS=10.2.10-h11
Palo Alto Networks PAN-OS=10.2.10-h12
Palo Alto Networks PAN-OS=10.2.10-h13
Palo Alto Networks PAN-OS=10.2.10-h2
Palo Alto Networks PAN-OS=10.2.10-h3
Palo Alto Networks PAN-OS=10.2.10-h4
Palo Alto Networks PAN-OS=10.2.10-h5
Palo Alto Networks PAN-OS=10.2.10-h6
Palo Alto Networks PAN-OS=10.2.10-h7
Palo Alto Networks PAN-OS=10.2.10-h8
Palo Alto Networks PAN-OS=10.2.10-h9
Palo Alto Networks PAN-OS=10.2.11
Palo Alto Networks PAN-OS=10.2.11-h1
Palo Alto Networks PAN-OS=10.2.11-h10
Palo Alto Networks PAN-OS=10.2.11-h11
Palo Alto Networks PAN-OS=10.2.11-h2
Palo Alto Networks PAN-OS=10.2.11-h3
Palo Alto Networks PAN-OS=10.2.11-h4
Palo Alto Networks PAN-OS=10.2.11-h5
Palo Alto Networks PAN-OS=10.2.11-h6
Palo Alto Networks PAN-OS=10.2.11-h7
Palo Alto Networks PAN-OS=10.2.11-h8
Palo Alto Networks PAN-OS=10.2.11-h9
Palo Alto Networks PAN-OS=10.2.12
Palo Alto Networks PAN-OS=10.2.12-h1
Palo Alto Networks PAN-OS=10.2.12-h2
Palo Alto Networks PAN-OS=10.2.12-h3
Palo Alto Networks PAN-OS=10.2.12-h4
Palo Alto Networks PAN-OS=10.2.12-h5
Palo Alto Networks PAN-OS=10.2.13
Palo Alto Networks PAN-OS=10.2.13-h1
Palo Alto Networks PAN-OS=10.2.13-h2
Palo Alto Networks PAN-OS=11.1.2
Palo Alto Networks PAN-OS=11.1.2-h1
Palo Alto Networks PAN-OS=11.1.2-h10
Palo Alto Networks PAN-OS=11.1.2-h11
Palo Alto Networks PAN-OS=11.1.2-h12
Palo Alto Networks PAN-OS=11.1.2-h13
Palo Alto Networks PAN-OS=11.1.2-h14
Palo Alto Networks PAN-OS=11.1.2-h15
Palo Alto Networks PAN-OS=11.1.2-h16
Palo Alto Networks PAN-OS=11.1.2-h17
Palo Alto Networks PAN-OS=11.1.2-h2
Palo Alto Networks PAN-OS=11.1.2-h3
Palo Alto Networks PAN-OS=11.1.2-h4
Palo Alto Networks PAN-OS=11.1.2-h5
Palo Alto Networks PAN-OS=11.1.2-h6
Palo Alto Networks PAN-OS=11.1.2-h7
Palo Alto Networks PAN-OS=11.1.2-h8
Palo Alto Networks PAN-OS=11.1.2-h9
Palo Alto Networks PAN-OS=11.1.3
Palo Alto Networks PAN-OS=11.1.4
Palo Alto Networks PAN-OS=11.1.4-h1
Palo Alto Networks PAN-OS=11.1.4-h10
Palo Alto Networks PAN-OS=11.1.4-h11
Palo Alto Networks PAN-OS=11.1.4-h12
Palo Alto Networks PAN-OS=11.1.4-h2
Palo Alto Networks PAN-OS=11.1.4-h3
Palo Alto Networks PAN-OS=11.1.4-h4
Palo Alto Networks PAN-OS=11.1.4-h5
Palo Alto Networks PAN-OS=11.1.4-h6
Palo Alto Networks PAN-OS=11.1.4-h7
Palo Alto Networks PAN-OS=11.1.4-h8
Palo Alto Networks PAN-OS=11.1.4-h9
Palo Alto Networks PAN-OS=11.1.5
Palo Alto Networks PAN-OS=11.1.6
Palo Alto Networks PAN-OS=11.2.4
Palo Alto Networks PAN-OS=11.2.4-h1
Palo Alto Networks PAN-OS=11.2.4-h2
Palo Alto Networks PAN-OS=11.2.4-h3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Palo Alto PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.1.14-h9Fixed in 10.2.7-h24Fixed in 10.2.8-h21Fixed in 10.2.9-h21Fixed in 10.2.12-h6Fixed in 10.2.13-h3Fixed in 10.2.10-h14Fixed in 10.2.11-h12Fixed in 11.1.6-h1Fixed in 11.1.2-h18Fixed in 11.1.4-h13Fixed in 11.2.4-h4Fixed in 11.2.5
  2. Upgrade

    Upgrade Palo Alto Networks PAN-OS 10.1 to a version that resolves this vulnerability.

    Fixed in 10.1.14-h9
  3. Upgrade

    Upgrade Palo Alto Networks PAN-OS 10.2 to a version that resolves this vulnerability.

    Fixed in 10.2.13-h3
  4. Upgrade

    Upgrade Palo Alto Networks PAN-OS 11.1 to a version that resolves this vulnerability.

    Fixed in 11.1.6-h1
  5. Upgrade

    Upgrade Palo Alto Networks PAN-OS 11.2 to a version that resolves this vulnerability.

    Fixed in 11.2.5 or later
  6. Configuration

    Restrict access to the PAN-OS management web interface to only trusted internal IP addresses per the administrative access best practices/critical deployment guidelines (per provided guidance).

    Palo Alto Networks PAN-OS management web interface Management interface access control = restrict to only trusted internal IP addresses
  7. Compensating control

    If you have a Threat Prevention subscription, block attacks for this vulnerability by enabling Threat ID 510000 and 510001 (introduced in Applications and Threats content version 8943).

Event History

Feb 12, 2025
Advisory Published
via Palo Alto Networks·05:00 PM
Known Exploited
via Palo Alto Networks·05:00 PM
CVE Published
via MITRE·08:55 PM
Data Sourced
via MITRE·08:55 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 14, 2025
News Published
via BleepingComputer·09:20 PM
Feb 18, 2025
News Published
via BleepingComputer·09:22 PM
Feb 19, 2025
News Published
via The Register·12:15 AM
News Published
via The Register·12:18 AM
News Published
via BleepingComputer·03:38 PM
News Published
via Dark Reading·04:39 PM
Feb 20, 2025
News Published
via Dark Reading·12:41 AM
Feb 21, 2025
News Published
via BleepingComputer·03:57 PM
Mar 6, 2025
Advisory Published
via Palo Alto Networks·11:00 PM
Nov 20, 2025
News Published
via BleepingComputer·05:08 PM
Jan 15, 2026
News Published
via BleepingComputer·09:02 AM
Jun 1, 2026
News Published
via Dark Reading·02:35 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-0108?

CVE-2025-0108 is categorized as a critical vulnerability due to the potential for unauthenticated access to sensitive management features.

2

How do I fix CVE-2025-0108?

To remediate CVE-2025-0108, upgrade to the latest patched versions of PAN-OS: 10.1.14-h9, 10.2.13-h3, 11.1.6-h1, or 11.2.4-h4.

3

What products are affected by CVE-2025-0108?

The affected products include Palo Alto Networks PAN-OS, Cloud NGFW, and Prisma Access.

4

Can CVE-2025-0108 be exploited remotely?

Yes, an attacker with network access can exploit CVE-2025-0108 remotely to bypass authentication on the management web interface.

5

What type of attack is CVE-2025-0108 associated with?

CVE-2025-0108 is associated with authentication bypass attacks that allow unauthorized access to management functionalities.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203