DaystoPatch

Palo Alto NetworksExploited incident

PAN-OS management web interface authentication bypass, chained with file read and CVE-2024-9474

CVE-2025-0108, CVE-2025-0111High, CVSS 8.8In CISA's Known Exploited Vulnerabilities catalog since 18 Feb 2025

  • Exploited after a fix existed
FixedFixed for every supported version 9 days after the first public report.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fixUnverified source
Follow-through
9d
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2025-0108 (advisory page)CuratedQuote not checked yet

    2025-02-12 Initial Publication

    Coordinated disclosure (reported by Assetnote, which published its write-up the same day). At publication: 'Palo Alto Networks is not aware of any malicious exploitation of this issue.' (Wayback 20250212233316). Exploitation attempts followed within days. Time from this timeline entry's data-date attribute (2025-02-12T17:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Bluesky postClaimedQuote not checked yet12 Feb 2025, 19:03 UTC

    Paloaltoの脆弱性情報 「CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface (Severity: HIGH)」が公開されました。

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-0108ClaimedQuote verified12 Feb 2025, 20:55 UTC

    An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5d7d0153be786119…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: greynoiseClaimedQuote verified13 Feb 2025

    GreyNoise Observes Active Exploitation of PAN-OS Authentication Bypass Vulnerability (CVE-2025-0108)

    Earliest mention we hold (a vetted outlet).

    Source
    Research: greynoise research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1037703b81576029…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Feb 2025, 18:38 UTC

    Nginx/Apache Path Confusion to Auth Bypass in PAN-OS (CVE-2025-0108) # CVE_2025_0108 https:// slcyber.io/blog/nginx-apache-p ath-confusion-to-auth-bypass-in-pan-os/

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-0108)ClaimedQuote verified18 Feb 2025

    Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2025-02-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-0111)ClaimedQuote verified20 Feb 2025

    Palo Alto Networks PAN-OS File Read Vulnerability

    Added to CISA's KEV catalog on 2025-02-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified

    Initial Publication.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2025-0108 (advisory page)CuratedQuote not checked yet12 Feb 2025, 17:00 UTC

    2025-02-12 Initial Publication

    CVE-2025-0111's advisory has the same initial publication time. Time from this timeline entry's data-date attribute (2025-02-12T17:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks advisory CVE-2025-0108 (Wayback snapshot 2025-02-12 23:33 UTC)CuratedQuote verified

    we strongly recommend that you secure access to your management interface according to our best practices deployment guid

    Mitigation (restrict management interface access) present at initial publication; a Threat Prevention Threat ID was added at 2025-02-12T23:45Z.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:30c8672669710dd9…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Palo Alto Networks advisory CVE-2025-0108ClaimedQuote verified12 Feb 2025, 23:45 UTC

    Added Threat Prevention Threat ID to Workarounds and Mitigations

    CaveatRevision mentions a workaround or mitigation; it may have existed earlier.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca4f886252f00fd3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified12 Feb 2025, 23:45 UTC

    Added Threat Prevention Threat ID to Workarounds and Mitigations.

    CaveatRevision mentions a workaround or mitigation; it may have existed earlier.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  4. First fix

    at disclosure

    Palo Alto Networks advisory CVE-2025-0108 (Wayback snapshot 2025-02-12 23:33 UTC)CuratedQuote verified

    Upgrade to 11.2.4-h4 or later

    Initial product status lists a fixed release for every affected train (11.2.4-h4, 11.1.6-h1, 10.2.13-h3, 10.1.14-h9) with no ETA. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:30c8672669710dd9…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    Palo Alto Networks advisory CVE-2025-0108ClaimedQuote verified18 Feb 2025, 19:30 UTC

    Updated fix availability for PAN-OS 10.2

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca4f886252f00fd3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified18 Feb 2025, 19:30 UTC

    Updated fix availability for PAN-OS 10.2.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0108ClaimedQuote verified18 Feb 2025, 23:00 UTC

    Updated the exploit status and solutions table

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca4f886252f00fd3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified18 Feb 2025, 23:00 UTC

    Updated exploit status and solution table.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0108ClaimedQuote verified19 Feb 2025, 23:15 UTC

    Updated fix availability for PAN-OS 10.2 and 11.1

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca4f886252f00fd3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified19 Feb 2025, 23:15 UTC

    Updated fix availability for PAN-OS 10.2 and 11.1.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0108ClaimedQuote verified21 Feb 2025, 17:10 UTC

    Updated fix availability for PAN-OS 11.1 and 11.2

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ca4f886252f00fd3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified21 Feb 2025, 17:10 UTC

    Updated fix availability for PAN-OS 11.1 and 11.2.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +9dUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2025-0108 (advisory page timeline)CuratedQuote not checked yet

    2025-02-21 Updated fix availability for PAN-OS 11.1 and 11.2

    R6 at maintenance-line granularity, as in PAN-3393/0257/0300: the final fixed-versions table lists hotfixes per maintenance line (10.2.7-h24, 10.2.8-h21, ..., 11.1.2-h18, 11.1.4-h13, 11.2.4-h4). The last lines were added by this entry (time from its data-date attribute); earlier additions were at 2025-02-18T19:30Z (10.2) and 2025-02-19T23:15Z (10.2 and 11.1). Each train already had a fix at initial publication (2025-02-12T17:00Z).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2025-0111ClaimedQuote verified21 Feb 2025, 17:10 UTC

    Updated fix availability for PAN-OS 11.1 and 11.2.

    CaveatLast change-log entry that touches fixes; the advisory now lists fixes for every affected branch.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:507739749cda9a57…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

This advisory changed after publication

  1. CVE-2025-0111

    Recorded in the revision history

    PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

    Version table: 9 rows added and 4 rows removed. One new row reads "PAN-OS 11.2 | = 11.2.4-h4 >= 11.2.5".

    • Fixed versions
    Version table rows
    BeforePAN-OS 11.2 | = 11.2.4-h4; PAN-OS 11.1 | = 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3; PAN-OS 11.2 | 11.2.0 through 11.2.4 | Upgrade to 11.2.4-h4 or later
    AfterPAN-OS 11.2 | = 11.2.4-h4 >= 11.2.5; PAN-OS 11.1 | = 11.1.2-h18 >= 11.1.4-h13 >= 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.10-h14 >= 10.2.11-h12 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.10 | Upgrade to 10.2.10-h14 or 10.2.13-h3 or later
    Earlier version captured 19 Feb 2025, 09:52 UTC: archived copyLater version captured 10 Mar 2025, 05:52 UTC: archived copyRecovered from archived copiesSnapshots cd15b3beec… and f6e8b52c81…Incident page

  2. CVE-2025-0108

    Recorded in the revision history

    PAN-OS: Authentication Bypass in the Management Web Interface

    Version table: 5 rows added and 2 rows removed. One new row reads "PAN-OS 11.1 | = 11.1.2-h18 >= 11.1.6-h1".

    • Fixed versions
    Version table rows
    BeforePAN-OS 11.1 | = 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3
    AfterPAN-OS 11.1 | = 11.1.2-h18 >= 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.10-h14 >= 10.2.11-h12 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.10 | Upgrade to 10.2.10-h14 or 10.2.13-h3 or later; 10.2.11 | Upgrade to 10.2.11-h12 or 10.2.13-h3 or later
    Earlier version captured 19 Feb 2025, 09:51 UTC: archived copyLater version captured 20 Feb 2025, 09:40 UTC: archived copyRecovered from archived copiesSnapshots 36bfe55f25… and f8504c379a…Incident page

  3. CVE-2025-0111

    Recorded in the revision history

    PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

    CVSS exploit maturity changed from unreported to attacked (displayed score 4.9 to 7.1). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 5 rows added and 1 row removed. One new row reads "PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3".

    • Severity
    • Exploitation status
    • Fixed versions
    CVSS exploit maturity
    Beforeunreported
    Afterattacked
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Version table rows
    BeforePAN-OS 10.2 | = 10.2.13-h3
    AfterPAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.7 | Upgrade to 10.2.7-h24 or 10.2.13-h3 or later; 10.2.8 | Upgrade to 10.2.8-h21 or 10.2.13-h3 or later; 10.2.9 | Upgrade to 10.2.9-h21 or 10.2.13-h3 or later
    Earlier version captured 15 Feb 2025, 08:27 UTC: archived copyLater version captured 19 Feb 2025, 09:52 UTC: archived copyRecovered from archived copiesSnapshots a3edc7c9ad… and cd15b3beec…Incident page

  4. CVE-2025-0108

    Recorded in the revision history

    PAN-OS: Authentication Bypass in the Management Web Interface

    CVSS exploit maturity changed from proof of concept to attacked (displayed score 7.8 to 8.8). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 5 rows added and 1 row removed. One new row reads "PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3".

    • Severity
    • Exploitation status
    • Fixed versions
    CVSS exploit maturity
    Beforeproof of concept
    Afterattacked
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Version table rows
    BeforePAN-OS 10.2 | = 10.2.13-h3
    AfterPAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.7 | Upgrade to 10.2.7-h24 or 10.2.13-h3 or later; 10.2.8 | Upgrade to 10.2.8-h21 or 10.2.13-h3 or later; 10.2.9 | Upgrade to 10.2.9-h21 or 10.2.13-h3 or later
    Earlier version captured 17 Feb 2025, 15:13 UTC: archived copyLater version captured 19 Feb 2025, 09:51 UTC: archived copyRecovered from archived copiesSnapshots 7184f6df86… and 36bfe55f25…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • PAN-OS (management web interface)
How we built this timeline

Grouping: separate advisories for CVE-2025-0108 (auth bypass, CVSS-B 8.8) and CVE-2025-0111 (authenticated file read, CVSS-B 7.1), both published 12 Feb 2025 with the same fixed releases; PAN later stated 'Palo Alto Networks has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces.', so they are one campaign.

KEV: CVE-2025-0108 18 Feb 2025, CVE-2025-0111 20 Feb 2025. Exploit status updated 18 Feb 2025 and 23:00Z.

Exploitation began after fixes existed, so exploited before a fix is false. GreyNoise reported exploitation attempts from 13 Feb 2025 (not fetched here).

R1 check (23 Oct 2026): 'bypass' is the vulnerability class; CVE-2025-0108 was found while analysing the CVE-2024-0012 patch but PAN treats it as a separate bug, not an incomplete fix of this incident.

The advisory notes 'PAN-OS 11.0 reached end of life (EoL) on November 17, 2024. No additional fixes are planned for this release.'; 11.0 is not counted for Fixed for all versions (R6).

R7: CVE-2025-0108 and CVE-2025-0111 were disclosed together (12 Feb 2025), so grouping is allowed; CVE-2024-9474 (disclosed 18 Nov 2024, more than 14 days earlier) stays a separate incident (palo-alto-networks-cve-2024-0012).

Related

No related incidents.

Palo Alto Networks report card