Attackers Exploit PAN-OS Management Interface Authentication Bypass

Palo Alto Networks disclosed CVE-2025-0108, an authentication bypass flaw in the PAN-OS management web interface, and related reporting shows attackers quickly began probing and exploiting exposed systems. MBSD-SOC said it observed attack attempts starting on 2025-02-14, just two days after public disclosure, and linked the activity to exploitation of both CVE-2025-0108 and the management interface file-read issue CVE-2025-0111. The attacks targeted PAN-OS versions across the 11.1, 10.2, and 10.1/11.2 branches, with public proof-of-concept code already available.

Observed attack traffic was led by sources in France, with additional activity from the United States, Japan, Russia, and Germany during February and March 2025. MBSD-SOC published an example HTTP request used to attempt authentication bypass against the web management interface and urged organizations to update affected firewalls immediately to the latest fixed PAN-OS releases, as internet-facing management interfaces remain a high-value target for opportunistic exploitation.