Exploited vulnerability · CISA KEV
Yes. CVE-2025-0108, Palo Alto Networks PAN-OS Authentication Bypass Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 18 Feb 2025, 6 days after it was published. It affects Palo Alto Networks PAN-OS, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
| Vendor | Palo Alto Networks (16 exploited CVEs in KEV) |
| Product | PAN-OS |
| Vulnerability | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
| Weakness | CWE-306 |
| Published | 12 Feb 2025 |
| Added to KEV | 18 Feb 2025 |
| Reported by (CNA) | palo_alto |
Yes. CISA added CVE-2025-0108 to the Known Exploited Vulnerabilities catalog on 18 Feb 2025, which means there is reliable evidence of exploitation in the wild.
CISA does not list known ransomware use for it. That can change, and exploitation alone is reason to fix it first.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check Palo Alto Networks's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected PAN-OS and watch it for signs of compromise.
Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in February 2025 · Palo Alto Networks scorecard · act-now radar.
We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.
Get in touch →