Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL

9.1 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitation Likelihood

EPSS Prediction

94.01 %

Predictive Probability

Percentile Rank

99.9 th

Documented as more likely to be exploited than 99.9% of known CVEs.

Detection Date

Feb 18, 2025

Remediation Due

Mar 11, 2025

CISA Catalog Active

Threat Analysis

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Asset Context

Vendor Identity

Palo Alto Networks

Affected Product

PAN-OS

Ransomware Status

Campaign Use Unknown

Weakness Classification

CWE-306

External Intelligence

https://security.paloaltonetworks.com/CVE-2025-0108

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-0108