# CVE-2025-0108: PAN-OS - Authentication Bypass

> Live exploitation tracking for CVE-2025-0108 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-0108

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Palo Alto Networks Prisma Access, Palo Alto Networks PAN-OS, Palo Alto Networks Cloud Ngfw
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** firewall, enterprise_software

## Description

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts.

## CrowdSec analysis

[CVE-2025-0108](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-0108) is an authentication bypass vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers with network access to the management web interface to bypass required authentication and invoke internal PHP scripts.

CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-0108 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2025-0108 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Exploitation attempts frequently target URLs containing the pattern `/unauth/%252e%252e/`.

## Timeline

- 2025-02-12: CVE Published. CVE-2025-0108 is published to NVD.
- 2025-02-18: Rule Released. CrowdSec releases a rule to detect CVE-2025-0108 exploitation attempts against the CrowdSec Network.
- 2025-02-18: CISA KEV. CVE-2025-0108 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-02-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-0108 for the first time.
- 2025-03-11: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://security.paloaltonetworks.com/CVE-2025-0108
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0108.yaml
- https://github.com/iSee857/CVE-2025-0108-PoC

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-0108) follows observed exploitation activity for CVE-2025-0108. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.