CVE-2025-0108: Palo Alto PAN-OS management-interface authentication bypass, actively exploited
The short version: CVE-2025-0108 is an authentication-bypass flaw in the PAN-OS management web interface caused by path confusion between the Nginx and Apache request handlers — double URL encoding plus directory traversal slips past the X-PAN-AuthCheck control. Palo Alto has observed attackers chaining it with CVE-2024-9474 and CVE-2025-0111 to reach root on unpatched, exposed interfaces. It's in CISA's KEV catalog. If your management interface is reachable, move. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice (chained to root) |
| CVSS v3.1 (NVD) | 9.1 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CVSS (Palo Alto) | 8.8 — High (urgency: highest) |
| EPSS | ~98.42% · 99.91st percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2025-03-11 |
| Known exploited? | Yes — actively exploited; chained with CVE-2024-9474 and CVE-2025-0111 |
| Vulnerability type | CWE-306 missing authentication for critical function (Nginx/Apache path confusion) → unauthenticated access to the management interface |
| Requires authenticated session? | No — pre-authentication |
| Affected | PAN-OS 10.1 < 10.1.14, 10.2 < 10.2.7, 11.2 < 11.2.4 (management web interface) |
| Fixed in | PAN-OS 10.1.14-h9 · 10.2.13-h3 (and other 10.2 hotfixes) · 11.1.6-h1 · 11.2.4-h4 (and later) |
| Not affected | Cloud NGFW and Prisma Access |
What you need to know
The PAN-OS management interface enforces authentication with an internal X-PAN-AuthCheck header. CVE-2025-0108 arises because Nginx and Apache disagree about how a path is parsed — a request with double URL encoding and directory traversal can be interpreted one way by the front-end and another by the back-end, letting an unauthenticated request reach protected functionality that should have required a login.
Why prioritize it:
- It's pre-authentication on the control plane. No credentials needed to reach management functionality.
- It's a chain link to root. Palo Alto observed CVE-2025-0108 chained with CVE-2024-9474 (privilege escalation) and CVE-2025-0111 (authenticated file read) to achieve full, root-level compromise of exposed firewalls.
- A public proof of concept exists and it is confirmed exploited — the theoretical is operational.
How serious we see it
Critical — in practice.
On its own the base score lands at 9.1 (Palo Alto rates the standalone bug 8.8, urgency highest). But the real-world story is the chain: unauthenticated bypass → privilege escalation → root on an internet-reachable firewall, actively exploited. We rate it by what it does in the wild, not by the standalone metric. The bounded, reassuring part: it affects specific PAN-OS builds, fixes are published, and keeping the management interface off the public internet neutralizes it.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to a fixed PAN-OS release (e.g. 10.1.14-h9 / 10.2.13-h3 / 11.1.6-h1 / 11.2.4-h4 or later).
- Restrict the management interface to trusted internal IPs. Per Palo Alto's best-practice guidance — this defeats the attack.
- Hunt for the chain. Review logs for signs of CVE-2025-0108 chained with CVE-2024-9474 / CVE-2025-0111.
- If compromised, respond fully. Rebuild where warranted and rotate all credentials, keys, and certificates on the device.
- Confirm your exposure first. Verify whether an affected PAN-OS management interface is reachable at all.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing PAN-OS management interfaces, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top because it's in KEV and unauthenticated.
That continuous, attacker's-eye view is exactly what you want when a management-plane bypass is being chained to root: the exposed interface is already mapped, so you can go straight to patch-and-verify.