Palo Alto Networks Patches Authentication Bypass Exploit in PAN

CVE-2024-9474 is an OS command injection flaw (CWE-78) in the Palo Alto Networks PAN-OS management web interface that allows a PAN-OS administrator to perform actions on the firewall with root privileges. It is triggered by an authenticated administrator through the management interface, and it becomes far more serious when chained with the separately disclosed CVE-2024-0012 management-interface authentication bypass, which hands unauthenticated attackers initial access before they escalate to root. A successful attacker gains root-level control of the device, enough to alter configurations, harvest credentials, and pivot into connected networks. Only PAN-OS deployments are affected — Palo Alto Networks states Cloud NGFW and Prisma Access are not impacted. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-11-18 with known ransomware use, reporting describes over 2,000 PAN-OS devices compromised in an ongoing campaign, and public PoC/exploit code is available.

Do: Upgrade affected PAN-OS systems to the patched releases identified in the Palo Alto Networks security advisory, and also remediate CVE-2024-0012, which attackers are chaining with this flaw. Until patched, ensure the management interface is not exposed to untrusted networks including the internet, per CISA's required action. Because successful attackers obtain root access, review management and configuration audit logs for unexpected activity and rotate management credentials on any device showing signs of compromise.

CVE-2025-0108 is a missing-authentication flaw (CWE-306) in the PAN-OS management web interface of Palo Alto Networks firewalls that lets an unauthenticated attacker with network access to that interface bypass login and invoke certain PHP scripts, reportedly via path-confusion tricks in the web server stack. Invoking the scripts does not yield remote code execution, but it can compromise the confidentiality and integrity of PAN-OS, such as by reading or modifying management-plane information. Any PAN-OS firewall whose management web interface is reachable by an attacker — for example, exposed to the internet or reachable from a compromised internal network — is affected, while Cloud NGFW and Prisma Access are not. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-18, a public proof-of-concept is available, EPSS puts the 30-day exploitation probability at 98.5%, and headlines report attackers chaining this bug with other PAN-OS flaws to breach firewalls.

Do: Upgrade PAN-OS to a fixed release per the Palo Alto Networks advisory (security.paloaltonetworks.com/CVE-2025-0108), since the vendor has patched the flaw. Until patched, restrict management web interface access to trusted internal IP addresses or management-only network zones as recommended in the vendor's hardening guidance. Check management-interface logs for unauthenticated requests to PHP scripts and for signs of chaining with other recently exploited PAN-OS vulnerabilities.

An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the “__openconfig” user (which has the Device Administrator role) on the firewall. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .