CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass

Source-specific exposure conditions

• PAN-OS management web-interface access is reachable from the internet or another untrusted network.
• Exposure can occur directly or through a dataplane interface with a management interface profile.
• GlobalProtect portals and gateways are not themselves vulnerable, but configuring a management profile on their interfaces exposes the device through the management web interface, typically on port 4443.
• Cloud NGFW and Prisma Access are not affected according to the vendor advisory.
• PAN-OS 11.0, 10.0, 9.1, 9.0, and older end-of-life releases are presumed affected because they are no longer evaluated and have no planned fixes.

Source-specific remediation

• Upgrade PAN-OS 10.1 installations to 10.1.14-h9 or later.
• For PAN-OS 10.2, upgrade to the applicable fixed release: 10.2.7-h24, 10.2.8-h21, 10.2.9-h21, 10.2.10-h14, 10.2.11-h12, 10.2.12-h6, or 10.2.13-h3 or later, as applicable to the installed minor release.
• For PAN-OS 11.1, upgrade to 11.1.2-h18, 11.1.4-h13, or 11.1.6-h1 or later, as applicable to the installed minor release.
• For PAN-OS 11.2, upgrade 11.2.4 installations to 11.2.4-h4 or later, or upgrade to 11.2.5 or later. Other 11.2 releases should be upgraded to 11.2.5 or later.
• Replace unsupported PAN-OS branches with a supported fixed version; the vendor states that no fixes are planned for the listed end-of-life branches.
• Immediately restrict management-interface access to trusted internal IP addresses or an approved jump box, rather than exposing it to the internet or untrusted networks.
• If a Threat Prevention subscription is available, enable vendor Threat IDs 510000 and 510001 using Applications and Threats content version 8943 or later, as an additional mitigation.

Source-specific verification

• Using an authorized administrative inventory or management interface, confirm the running PAN-OS version and compare it with the applicable fixed-version threshold in the Palo Alto Networks advisory.
• Confirm that management-interface access is limited to trusted internal IP addresses or an approved jump box, and that no internet-facing or untrusted dataplane interface has a management interface profile.
• Review the Palo Alto Networks Customer Support Portal Assets section at Products → Assets → All Assets → Remediation Required for devices tagged PAN-SA-2024-0015; the vendor notes that absence from the list only means its recent scan did not identify an exposed device and is not a complete configuration validation.
• If relying on the Threat Prevention mitigation, confirm through authorized administrative review that Threat IDs 510000 and 510001 are enabled and that the required Applications and Threats content version is installed.

Uncertainty and evidence gaps

• The supplied source record lists selected affected CPEs and thresholds, while the vendor advisory provides branch-specific hotfix paths; the vendor advisory should control remediation selection.
• The vendor advisory does not establish that a particular customer device is currently exposed or compromised; exposure must be determined from the device's management-interface configuration and authorized asset inventory.
• A version comparison alone does not establish whether the management interface is reachable from an untrusted network.
• The vendor's Threat Prevention mitigation is conditional on a Threat Prevention subscription and the specified content version.

Claim-to-source evidence

• Affected Product: PAN-OS is affected; Cloud NGFW and Prisma Access are listed as unaffected. Evidence
• Affected Version: Affected PAN-OS ranges include versions below the vendor-listed fixed releases in the 10.1, 10.2, 11.1, and 11.2 branches; listed end-of-life branches are presumed affected. Evidence
• Exposure: Exploitation requires network access to the PAN-OS management web interface; risk is greatest when it is reachable from the internet or an untrusted network, directly or through a dataplane interface with a management interface profile. Evidence
• Fixed Version: Vendor fixed-version thresholds include 10.1.14-h9, 10.2.7-h24, 10.2.8-h21, 10.2.9-h21, 10.2.10-h14, 10.2.11-h12, 10.2.12-h6, 10.2.13-h3, 11.1.2-h18, 11.1.4-h13, 11.1.6-h1, 11.2.4-h4, and 11.2.5, depending on the installed branch and minor release. Evidence
• Remediation: Palo Alto Networks recommends upgrading to the applicable fixed release and restricting management-interface access to trusted internal IP addresses or a jump box; it also documents Threat IDs 510000 and 510001 as an additional mitigation when the required subscription and content version are available. Evidence
• Verification: The advisory provides an administrative verification path through the Customer Support Portal's Remediation Required asset list and recommends validating that management access is restricted to trusted internal IP addresses. Evidence

Synthesis sources

• security.paloaltonetworks.com
• nvd.nist.gov

Generation provenance

Model

gpt-5.6-luna

Generated

2026-07-25T21:31:49Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

561c8b85ead1e1280e4bc92da62319f7ad59588431b4627ae85573389c3373ce