Loading story…
Palo Alto Networks disclosed CVE-2025-0108, an authentication bypass flaw in the PAN-OS management web interface, and related reporting shows attackers quickly began probing and exploiting exposed systems. MBSD-SOC said it observed attack attempts starting on 2025-02-14, just two days after public disclosure, and linked the activity to exploitation of both CVE-2025-0108 and the management interface file-read issue CVE-2025-0111. The attacks targeted PAN-OS versions across the 11.1, 10.2, and 10.1/11.2 branches, with public proof-of-concept code already available.
Observed attack traffic was led by sources in France, with additional activity from the United States, Japan, Russia, and Germany during February and March 2025. MBSD-SOC published an example HTTP request used to attempt authentication bypass against the web management interface and urged organizations to update affected firewalls immediately to the latest fixed PAN-OS releases, as internet-facing management interfaces remain a high-value target for opportunistic exploitation.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported increased attack activity during March 2025 against the PAN-OS management interface vulnerabilities CVE-2025-0108 and CVE-2025-0111. The observed traffic primarily originated from France, with additional activity from Japan, the United States, Russia, and Germany.
MBSD-SOC observed attacks targeting CVE-2025-0108 and CVE-2025-0111 starting on February 14, including requests attempting to bypass authentication on the PAN-OS management interface. The report also notes that proof-of-concept code had already been published.
MBSD-SOC reported that CVE-2025-0111, a file read vulnerability in the PAN-OS management web interface, was publicly disclosed. The report ties its disclosure to the same date as CVE-2025-0108.
Palo Alto Networks publicly disclosed CVE-2025-0108, an authentication bypass vulnerability affecting the PAN-OS management web interface. The MBSD-SOC report states this disclosure occurred on the same day as CVE-2025-0111.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **`CVE-2024-0012`**, a critical authentication-bypass flaw in the **PAN-OS management web interface**, and reports tied the issue to active in-the-wild exploitation against internet-exposed firewall management interfaces. Public reporting and vendor guidance indicate the weakness could enable unauthenticated command execution in affected deployments, while **Prisma Access** and **Cloud NGFW** were not impacted. Affected versions included PAN-OS releases earlier than **10.2.12-h2**, **11.0.6-h1**, **11.1.5-h1**, and **11.2.4-h1**. Palo Alto Networks first urged customers to restrict management-interface exposure and follow hardening guidance for administrative access, then released fixes for affected branches. Incident-response reporting also cited published indicators of compromise, including attacker IP addresses and a **SHA-256** hash for a PHP webshell observed in related activity, underscoring the need to patch exposed devices and review management-plane access controls.
Sep 3, 2026
Palo Alto Networks disclosed **CVE-2026-0257**, an authentication bypass flaw in **PAN-OS GlobalProtect portal and gateway** that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while **Cloud NGFW** and **Panorama** were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override. Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to **Vultr** and **Dromatics Systems**. **CISA** added `CVE-2026-0257` to its **Known Exploited Vulnerabilities** catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including **OT/SCADA** networks. A separate Palo Alto advisory released alongside it also addressed **CVE-2026-0262**, a PAN-OS network traffic parsing denial-of-service issue.
Aug 31, 2026
Palo Alto Networks disclosed **CVE-2026-0300**, a critical `CWE-787` buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows **unauthenticated remote code execution as root** on affected **PA-Series** and **VM-Series** firewalls. The flaw carries a **CVSS v4 score of 9.3** when the portal is exposed to untrusted networks or the public internet, and Palo Alto confirmed limited in-the-wild exploitation against exposed portals. Affected versions span PAN-OS 10.2, 11.1, 11.2, and 12.1, while **Prisma Access, Cloud NGFW, and Panorama are not affected**. With patches not immediately available at disclosure, Palo Alto said fixed releases would begin rolling out between May 13 and May 28 and urged customers to restrict portal access to trusted internal zones or disable the feature entirely; the company also released a Threat Prevention Signature for PAN-OS 11.1 and later. U.S. **CISA** added the vulnerability to its **Known Exploited Vulnerabilities** catalog and ordered federal civilian agencies to remediate by the mandated deadline, while other national and regional cyber authorities issued parallel alerts. Palo Alto Unit 42 and multiple reports linked the activity to a likely state-sponsored cluster tracked as **CL-STA-1132**, which reportedly probed targets for weeks, injected shellcode into an `nginx` worker process, deleted crash artifacts and logs, enumerated Active Directory through firewall-linked service accounts, and used **EarthWorm** and **ReverseSocks5** tunnels for command and control and lateral movement. Researchers warned that thousands of internet-exposed PAN-OS instances remain reachable, making perimeter firewalls with exposed Captive Portal services high-priority compromise candidates.
Jun 29, 2026