Exploited vulnerability · CISA KEV
Yes. CVE-2025-0111, Palo Alto Networks PAN-OS File Read Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 20 Feb 2025, 8 days after it was published. It affects Palo Alto Networks PAN-OS, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
| Vendor | Palo Alto Networks (16 exploited CVEs in KEV) |
| Product | PAN-OS |
| Vulnerability | Palo Alto Networks PAN-OS File Read Vulnerability |
| Weakness | CWE-73 |
| Published | 12 Feb 2025 |
| Added to KEV | 20 Feb 2025 |
| Reported by (CNA) | palo_alto |
Yes. CISA added CVE-2025-0111 to the Known Exploited Vulnerabilities catalog on 20 Feb 2025, which means there is reliable evidence of exploitation in the wild.
CISA does not list known ransomware use for it. That can change, and exploitation alone is reason to fix it first.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check Palo Alto Networks's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected PAN-OS and watch it for signs of compromise.
Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in February 2025 · Palo Alto Networks scorecard · act-now radar.
We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.
Get in touch →