CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CVE-2025-0108 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS that affects the management web interface. An unauthenticated attacker who can reach that interface over the network can skip normal login checks and invoke certain PHP scripts. Because the management plane controls firewall policy, logging, and device configuration, successful abuse can give an outsider a foothold on a security appliance that sits at the edge of many networks.

Defenders should treat any internet- or broadly reachable management interface as high priority until they confirm the device is patched or otherwise isolated. Public detail on exact affected releases and exploit mechanics is limited; always verify against the current Palo Alto Networks advisory.

How it works

The underlying weakness is CWE-306: missing authentication for a critical function. In this case the critical function is the set of PHP scripts that the PAN-OS management web interface exposes. Under normal conditions those scripts should be reachable only after successful authentication. The flaw allows an attacker who merely has network connectivity to the interface to call the scripts without presenting valid credentials.

Once authentication is bypassed, the attacker can interact with whatever functionality those scripts provide. Exact script names, parameters, and post-bypass actions are not detailed in the public summary; they must be confirmed against the vendor advisory. The practical result is that an unauthenticated party can perform actions that the product designers intended only for authenticated administrators.

Am I affected? How to find it in your systems

PAN-OS runs on Palo Alto Networks next-generation firewalls and related appliances. The vulnerable surface is the management web interface (typically HTTPS on TCP 443, though the port may be customized). Inventory every PAN-OS device in your environment—physical, virtual, and cloud-hosted—and determine whether the management interface is reachable from untrusted networks.

• Query asset-management or configuration-management databases for “PAN-OS,” “Palo Alto,” or the appliance model numbers.
• Scan internal and external address space for open management ports; confirm ownership with banner or certificate inspection.
• Review firewall and VPN rules that permit access to management interfaces; any rule that allows traffic from outside the administrative jump-host or management VLAN is a candidate for exposure.
• Check device software version against the list published in the Palo Alto Networks advisory for CVE-2025-0108; do not rely on third-party version tables.

Telemetry that may indicate exploitation includes unexpected HTTP requests to management-interface paths that normally require authentication, sudden configuration changes, or new administrative sessions originating from unfamiliar source addresses. Correlate web-server access logs on the firewall with authentication logs; a successful script invocation without a preceding successful login is a strong indicator.

How to remediate

The primary remediation is to apply the vendor-supplied update that addresses CVE-2025-0108. Follow the exact upgrade path and release notes published by Palo Alto Networks; confirm the fixed version for your hardware or virtual platform before scheduling the change window.

• Download the update only from official Palo Alto Networks channels.
• Test the new image in a lab or non-production pair if high availability is in use.
• After upgrade, re-verify that the management interface still requires authentication for the previously vulnerable scripts.

In addition to patching, harden the management plane: restrict access to a dedicated management network or jump hosts, enforce multi-factor authentication for all administrative accounts, and disable unused management services. These steps reduce the attack surface even after the authentication bypass is closed.

If you can't patch immediately

If an immediate upgrade is not feasible, apply compensating controls that prevent unauthenticated network access to the management web interface.

• Place the management interface behind an allow-list that permits only trusted administrative source addresses; block all other traffic at an upstream firewall or on the device itself.
• If the interface must remain reachable, deploy a web-application firewall or reverse-proxy rule that drops requests lacking valid session cookies or authentication headers; treat this as temporary virtual patching only.
• Disable the web management interface entirely if CLI or API access via a secure out-of-band channel is sufficient for operations.
• Increase logging and alerting for any connection attempt to the management port; forward logs to a SIEM and create high-priority alerts for unauthenticated script invocations.

These measures do not eliminate the vulnerability but shrink the window of exposure until the official patch can be applied. CISA guidance is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

If your data may have been exposed

Actively exploited authentication-bypass flaws on management interfaces have historically led to full device compromise and subsequent lateral movement or data exfiltration. While ransomware use of this specific CVE is not documented, any successful bypass should be treated as a potential breach. Review configuration change history, administrative account activity, and outbound traffic from the firewall for signs of unauthorized use. As a quick check for previously leaked credentials, you can run a free exposure scan of your email addresses against known breach data sets.