VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 13:41 UTC
← Dashboard

CVE-2025-0108

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While …

Read full description
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.8: +1.32
  • Fresh EPSS: 98.45%: +0.49

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 18 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Cyber Press
Press · 20 Nov 2025, 08:00 · 2.3 Million Attacks Hit Palo Alto Networks’ GlobalProtect VPN Portals - Cyber Press
Cybersecurity Dive
Press · 24 Feb 2025, 08:00 · Palo Alto Networks warns hackers attempting to exploit a file read flaw in firewalls - Cybersecurity Dive
TechTarget
Press · 21 Feb 2025, 08:00 · Palo Alto Networks vulnerabilities exploited in chained attack - TechTarget
SecurityWeek
Press · 21 Feb 2025, 08:00 · Second Recently Patched Flaw Exploited to Hack Palo Alto Firewalls - SecurityWeek
SOC Prime
Press · 21 Feb 2025, 08:00 · CVE-2025-20059: Relative Path Traversal Vulnerability in Ping Identity PingAM Java Policy Agent - SOC Prime
See all 18 source documents
SOC Prime
Press · 20 Feb 2025, 08:00 · CVE-2025-0108 Detection: Active Exploitation of an Authentication Bypass Palo Alto Networks PAN-OS Software - SOC Prime
BleepingComputer
Press · 19 Feb 2025, 08:00 · Palo Alto Networks tags new firewall bug as exploited in attacks - BleepingComputer
The Register
Press · 19 Feb 2025, 08:00 · Palo Alto warns firewalls flaws are under active attack - The Register
TechTarget
Press · 18 Feb 2025, 08:00 · Palo Alto Networks PAN-OS vulnerability exploited in the wild - TechTarget
Arctic Wolf
Press · 18 Feb 2025, 08:00 · Exploitation Attempts Chaining CVE-2025-0108 with CVE-2024-9474 - Arctic Wolf
SecurityWeek
Press · 18 Feb 2025, 08:00 · Palo Alto Networks Confirms Exploitation of Firewall Vulnerability - SecurityWeek
TechTarget
Press · 18 Feb 2025, 08:00 · Palo Alto Networks PAN-OS vulnerability exploited in the wild - TechTarget
SecurityWeek
Press · 14 Feb 2025, 08:00 · Hackers Exploit Palo Alto Firewall Vulnerability Day After Disclosure - SecurityWeek
SOCRadar
Press · 14 Feb 2025, 08:00 · Palo Alto Firewall Flaw Under Attack – Are You at Risk? - SOCRadar
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 13 Feb 2025, 08:00 · Palo Alto PAN-OS Multiple vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre
The Hacker News
Press · 13 Feb 2025, 08:00 · Palo Alto Networks Patches Authentication Bypass Exploit in PAN-OS Software - The Hacker News
GreyNoise
Press · 13 Feb 2025, 08:00 · GreyNoise Observes Active Exploitation of PAN-OS Authentication Bypass Vulnerability (CVE-2025-0108) - GreyNoise
Help Net Security
Press · 13 Feb 2025, 08:00 · PAN-OS authentication bypass hole plugged, PoC is public (CVE-2025-0108) - Help Net Security

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.8 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

3

Public exploit entries / repo candidates

See 3 repos with metrics
RepositoryStarsForksLanguageUpdated
iSee857/CVE-2025-0108-PoC3319Python01 Apr 2025, 08:49
FOLKS-iwd/CVE-2025-0108-PoC82—14 Feb 2025, 13:50
sohaibeb/CVE-2025-010810Python20 Feb 2025, 07:48
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.8; EPSS 98.5%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:25.323730+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
12 Feb 2025, 20:55
First press mention
13 Feb 2025, 08:00
Added to the CISA KEV catalog
18 Feb 2025, 00:00
Latest press mention
20 Nov 2025, 08:00
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
3 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar