CVE-2025-0108: PAN-OS management web interface authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed in-the-wild exploitation, has an EPSS near 0.98, and allows unauthenticated network access to the firewall management plane.

What it is

PAN-OS contains a missing-authentication flaw (CWE-306) in the management web interface that lets an unauthenticated attacker with network access invoke certain PHP scripts without logging in. It does not lead to remote code execution, but it undermines the confidentiality and integrity of the firewall's management plane.

Impact

An attacker gains unauthenticated access to management web interface functionality, allowing them to read and alter data exposed by the affected PHP scripts. No code execution is achieved, but the management plane's integrity and confidentiality are compromised.

Attack surface

Reachable over the network via the PAN-OS management web interface; the CVSS 4.0 vector shows PR:N and UI:N, so no authentication or user interaction is required. Exposure is limited to interfaces where the management web UI is reachable, which the vendor advises restricting to trusted internal IPs.

Exploitation

CISA added it to KEV on 2025-02-18 with a 2025-03-11 remediation due, and multiple references are tagged Exploit, indicating active exploitation in the wild. EPSS is 0.98455 (99.9th percentile), consistent with high near-term exploitation likelihood.

What to do

• Apply the vendor patch for PAN-OS per the Palo Alto Networks advisory.
• Restrict management web interface access to trusted internal IP addresses only.
• Isolate the management interface from untrusted networks and the public internet.
• If patching is not immediately possible, follow vendor mitigations or discontinue use of the product as directed by CISA.
• Review management interface exposure and firewall rules for any internet-facing management access.

Detection

• Monitor management web interface logs for requests to PHP scripts that occur without a preceding successful authentication.
• Alert on anomalous or unexpected access to the PAN-OS management web interface from untrusted or external source IPs.
• Hunt for exploitation attempts using the public PoC and vendor advisory indicators against management interface access logs.
• Correlate management interface access with configuration or data changes that lack a corresponding authenticated session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.