CVE-2025-0108
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Description
CVE-2025-0108 is a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS that allows an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts, negatively impacting system integrity and confidentiality. Rated with a CVSS v3.1 base score of 9.1, this vulnerability affects multiple PAN-OS versions across the 10.1, 10.2, 11.1, and 11.2 release branches. CISA has added CVE-2025-0108 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 11, 2025, confirming widespread active exploitation. The EPSS score of 94.01% at the 99.9th percentile places this among the most actively exploited vulnerabilities currently tracked worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | >= 10.1.0, < 10.1.14; >= 10.2.0, < 10.2.7; >= 11.1.0, < 11.1.2; >= 11.2.0, < 11.2.4; 10.1.14; 10.2.7; 10.2.8; 10.2.9; 10.2.10; 10.2.11; 10.2.12; 10.2.13; 11.1.2; 11.1.3; 11.1.4; 11.1.5; 11.1.6; 11.2.4 |
References
- https://security.paloaltonetworks.com/CVE-2025-0108(Exploit, Vendor Advisory)
- https://github.com/iSee857/CVE-2025-0108-PoC(Exploit, Third Party Advisory)
- https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/(Exploit, Press/Media Coverage)
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks/(Press/Media Coverage, Third Party Advisory)
- https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild(Press/Media Coverage, Third Party Advisory)
- https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability/(Press/Media Coverage, Third Party Advisory)
- https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/(Press/Media Coverage, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0108(US Government Resource)
Weakness Type
Authentication Bypass via Path Confusion
CVE-2025-0108 exploits a path confusion vulnerability between the Nginx reverse proxy and the Apache backend in PAN-OS to bypass authentication on the management web interface. This type of weakness occurs when two web server components interpret URL paths differently, allowing an attacker to craft requests that the proxy considers unauthenticated but the backend processes as authenticated. The architectural mismatch between Nginx and Apache path normalization creates a trust boundary violation that completely undermines the authentication layer.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2025-0108 poses an extreme risk to organizations with internet-exposed PAN-OS management interfaces. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). Confidentiality (High): By bypassing authentication and invoking PHP scripts on the management interface, an attacker can access sensitive firewall configuration data, user credentials, VPN configurations, routing tables, security policies, and network topology information. This intelligence enables comprehensive network reconnaissance and facilitates deeper intrusion. Integrity (High): The ability to invoke certain PHP scripts without authentication allows an attacker to potentially modify firewall configurations, alter security policies, manipulate routing rules, and undermine the security posture of the entire network perimeter. Availability: While the CVSS vector does not indicate a direct availability impact (A:N), the integrity compromise of a perimeter firewall has devastating downstream consequences for network availability and security. The EPSS score of 94.01% at the 99.9th percentile confirms near-certain exploitation, making this one of the most actively targeted vulnerabilities in the current threat landscape. The ransomware status is listed as Unknown, but authentication bypass on a network perimeter device creates an ideal entry point for ransomware campaigns.
Exploit Maturity
CVE-2025-0108 has reached maximum exploit maturity with multiple publicly available exploits and confirmed widespread exploitation. Public proof-of-concept exploits are available from multiple sources, including the Palo Alto Networks security advisory (tagged as Exploit), a GitHub PoC repository by iSee857, and a detailed technical write-up by SLCyber explaining the Nginx/Apache path confusion technique. CISA has confirmed active exploitation by adding this to the KEV catalog with a remediation deadline of March 11, 2025. Major security publications including BleepingComputer, Dark Reading, SecurityWeek, and The Register have reported on active exploitation campaigns targeting this vulnerability. The EPSS score of 94.01% at the 99.9th percentile confirms near-certain exploitation activity, placing it among the top 0.1% of all tracked vulnerabilities. The ransomware use status is listed as Unknown by CISA.
Remediation
-
Upgrade PAN-OS to a patched version immediately. Apply the following minimum versions based on your PAN-OS branch: 10.1.14-h9 or later for the 10.1 branch, 10.2.13-h3 or later for the 10.2 branch, 11.1.6-h1 or later for the 11.1 branch, and 11.2.4-h4 or later for the 11.2 branch. Consult the Palo Alto Networks security advisory for exact patched versions.
-
Block all internet access to the management web interface immediately. This is the most critical emergency mitigation. Ensure the PAN-OS management interface is only accessible from trusted internal IP addresses through dedicated management networks. Any internet-facing management interface is actively being targeted.
-
Audit management interface access logs for exploitation indicators. Review PAN-OS web server logs for suspicious requests that may indicate authentication bypass attempts, particularly unusual URL patterns targeting PHP scripts. Look for access from unexpected IP addresses and any configuration changes that were not authorized by administrators.
-
Implement comprehensive network segmentation for management traffic. Place all firewall management interfaces on an isolated management VLAN with strict access controls. Require VPN or jump server access for all administrative operations and enforce multi-factor authentication for management sessions.
-
Patch related vulnerabilities simultaneously. CVE-2025-0108 may be chained with other PAN-OS vulnerabilities such as CVE-2025-0111 (authenticated file read) for enhanced exploitation. Ensure all current PAN-OS security advisories are addressed in a single maintenance window to prevent chained attack scenarios.
Technical Details
CVE-2025-0108 is an authentication bypass vulnerability in the Palo Alto Networks PAN-OS management web interface caused by a path confusion between the Nginx reverse proxy and the Apache web server backend. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reveals: Attack Vector (Network): Exploitable remotely through the PAN-OS management web interface. Attack Complexity (Low): The path confusion technique is well-documented and easily reproducible. Privileges Required (None): No authentication is needed — this is a pre-authentication bypass. User Interaction (None): The attack is fully automated. Confidentiality and Integrity (High): The attacker can read sensitive data and invoke PHP scripts that modify system state. The vulnerability's root cause, as detailed in the SLCyber technical analysis, lies in the architectural difference between how Nginx and Apache normalize and route URL paths. The PAN-OS management interface uses Nginx as a front-end reverse proxy that enforces authentication requirements based on URL path matching. Behind Nginx, Apache serves the actual PHP application. By crafting URLs with specific path components (such as path traversal sequences, URL-encoded characters, or path separator variations), an attacker can cause Nginx to classify the request as accessing an unauthenticated resource while Apache routes it to an authenticated PHP script. This Nginx/Apache path confusion effectively bypasses the entire authentication layer, allowing invocation of management PHP scripts that can read configuration data and modify system settings. The affected versions span PAN-OS 10.1.x before 10.1.14, 10.2.x before 10.2.7, 11.1.x before 11.1.2, and 11.2.x before 11.2.4, with numerous specific sub-versions listed in the advisory.
Frequently Asked Questions
Is CVE-2025-0108 being actively exploited?
Yes, extensively. CISA has confirmed widespread active exploitation, and the EPSS score of 94.01% at the 99.9th percentile places it among the most actively exploited vulnerabilities worldwide. Multiple proof-of-concept exploits are publicly available, and major security publications have reported active exploitation campaigns.
Can CVE-2025-0108 be exploited without authentication?
Yes. CVE-2025-0108 is a pre-authentication bypass vulnerability. No credentials or prior access are needed. Any attacker who can reach the PAN-OS management web interface can exploit this vulnerability to bypass authentication and invoke PHP scripts on the system.
How does the CVE-2025-0108 authentication bypass work?
The vulnerability exploits a path confusion between the Nginx reverse proxy and Apache backend in PAN-OS. By crafting specific URLs, an attacker causes Nginx to skip authentication checks while Apache still routes the request to protected PHP scripts, effectively bypassing the entire authentication layer.
Is CVE-2025-0108 related to other PAN-OS vulnerabilities?
Yes. CVE-2025-0108 can potentially be chained with CVE-2025-0111 (an authenticated file read vulnerability) for enhanced exploitation. An attacker could first bypass authentication using CVE-2025-0108 and then leverage CVE-2025-0111 to read sensitive files from the PAN-OS filesystem. Both should be patched simultaneously.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.