CVE-2025-0108:

An authentication bypass in Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to bypass login and invoke certain PHP scripts, potentially compromising integrity and confidentiality. The issue does not grant remote code execution and is most risky when the management interface is exposed to untrusted networks; affected PAN-OS versions span multiple 10.x and 11.x releases, while Cloud NGFW and Prisma Access are not affected. Fixes have been released for specific PAN-OS builds; administrators should apply the recommended upgrades and restrict management access.

CVE-2025-0108 is a PAN-OS authentication bypass vulnerability that permits an unauthenticated network-based attacker to bypass management web interface authentication and trigger certain PHP scripts, potentially exposing PAN-OS to integrity and confidentiality risks. The flaw does not enable remote code execution. The highest risk occurs when management access is reachable from the internet or untrusted networks. Affected products include PAN-OS across multiple versions; Cloud NGFW and Prisma Access are not impacted. Fixed versions include upgrades to 10.1.14-h9 or later, 10.2.13-h3 or later, 11.1.6-h1 or later, and 11.2.4-h4 or later, with additional interim fixes for certain subversions. The issue is tracked under CWE-306 Missing Authentication for Critical Function.