CVE-2025-0127: PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series (Severity: MEDIUM)

Published Apr 9, 2025

Updated

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Affected Software

2 affected components

Palo Alto Networks Cloud NGFW

Palo Alto Networks Prisma Access

Remediation

Mitigation

No workaround or mitigation is available.

Information

VERSION MINOR VERSION SUGGESTED SOLUTION PAN-OS 11.2 on VM-Series No action needed PAN-OS 11.1 on VM-Series No action needed PAN-OS 11.0 on VM-Series 11.0.0 through 11.0.3 Upgrade to 11.0.4 or later PAN-OS 10.2 on VM-Series 10.2.0 through 10.2.8 Upgrade to 10.2.9 or later PAN-OS 10.1 on VM-Series 10.1.0 through 10.1.14 Upgrade to 10.1.14-h13 or later PAN-OS on non VM-Series platforms No action needed All other older unsupported PAN-OS versions Upgrade to a supported fixed version PAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade from this EoL vulnerable version to a fixed version.

Event History

Apr 9, 2025

Advisory Published

via Palo Alto Networks·04:00 PM

Apr 11, 2025

CVE Published

via MITRE·02:01 AM

Data Sourced

via MITRE·02:01 AM

DescriptionWeakness

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0127?

CVE-2025-0127 has a high severity due to its potential to allow an authenticated administrator to run arbitrary commands as a root user.

How do I fix CVE-2025-0127?

To mitigate CVE-2025-0127, ensure that your PAN-OS is updated to the latest version provided by Palo Alto Networks that addresses this vulnerability.

Who is affected by CVE-2025-0127?

CVE-2025-0127 specifically affects Palo Alto Networks PAN-OS VM-Series systems utilized by authenticated administrators.

What are the risks associated with CVE-2025-0127?

The risks of CVE-2025-0127 include unauthorized access and the potential for an attacker to execute arbitrary commands on the vulnerable system.

Is CVE-2025-0127 relevant to all Palo Alto Networks products?

No, CVE-2025-0127 is only applicable to PAN-OS VM-Series and does not impact other Palo Alto Networks firewall products.