CVE-2025-0111: PAN-OS authenticated file read via management web interface

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is high severity, requires authentication but no user interaction, and is listed in CISA KEV as exploited, making it a priority for patching and management interface restriction.

What it is

PAN-OS contains an authenticated file read vulnerability that lets a user with network access to the management web interface read files on the PAN-OS filesystem that are readable by the "nobody" user. The flaw is a path/file access control weakness (CWE-73, CWE-610) and is rated high severity (CVSS 4.0 7.1). It matters because it exposes sensitive local files to any authenticated management user, and CISA added it to the Known Exploited Vulnerabilities catalog.

Impact

An attacker with valid credentials and management web interface access can read files on the PAN-OS filesystem accessible to the "nobody" account. This can expose configuration data, credentials, or other sensitive local files, though integrity and availability are not affected.

Attack surface

Reached over the network through the PAN-OS management web interface; the attacker must be authenticated (PR:L) and have network access to that interface. No user interaction is required (UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-02-20, indicating known exploitation, while EPSS is low at 0.01999 (79.7th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor patch or fixed PAN-OS release per the Palo Alto Networks advisory.
• Restrict management web interface access to trusted internal IP addresses only.
• Disable or limit management interface exposure to untrusted networks.
• Enforce least privilege and review accounts with management web interface access.
• Monitor for and rotate any credentials or secrets that may have been exposed in readable files.

Detection

• Review management web interface access logs for unusual or unexpected authenticated sessions.
• Hunt for requests to management interface endpoints that attempt to read arbitrary filesystem paths.
• Alert on access to the management interface from IP addresses outside trusted internal ranges.
• Correlate authentication events with subsequent file access or configuration export activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.