Loading story…
A vulnerability in the Palo Alto Networks PAN-OS management interface, tracked as CVE-2025-0108 and internally as PAN-273971, permits unauthenticated access to the Zero Touch Provisioning endpoint at /php/ztp_gate.php. The flaw stems from inconsistent URL decoding and path normalization between the Nginx reverse proxy and Apache mod_rewrite: Nginx can classify a crafted double-encoded traversal request as unauthenticated while Apache resolves it to a protected PHP resource.
The issue was identified while examining fixes for the previously exploited PAN-OS vulnerabilities CVE-2024-0012 and CVE-2024-9474. Palo Alto Networks remediated the flaw in PAN-OS 10.2.14, 11.0.7, 11.2.5, and later releases; organizations should update affected firewalls and restrict management-interface access through IP allowlisting.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks tracked the authentication-bypass issue as PAN-273971 and fixed it in PAN-OS 10.2.14, 11.0.7, 11.2.5, and later versions. The company recommended IP allowlisting access to the management interface to reduce exposure.
Assetnote identified a full authentication bypass in the Palo Alto Networks PAN-OS management interface, caused by inconsistent URL decoding and path handling between Nginx and Apache/mod_rewrite. A double-encoded traversal request could reach and execute the Zero Touch Provisioning endpoint /php/ztp_gate.php without authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **`CVE-2024-0012`**, a critical authentication-bypass flaw in the **PAN-OS management web interface**, and reports tied the issue to active in-the-wild exploitation against internet-exposed firewall management interfaces. Public reporting and vendor guidance indicate the weakness could enable unauthenticated command execution in affected deployments, while **Prisma Access** and **Cloud NGFW** were not impacted. Affected versions included PAN-OS releases earlier than **10.2.12-h2**, **11.0.6-h1**, **11.1.5-h1**, and **11.2.4-h1**. Palo Alto Networks first urged customers to restrict management-interface exposure and follow hardening guidance for administrative access, then released fixes for affected branches. Incident-response reporting also cited published indicators of compromise, including attacker IP addresses and a **SHA-256** hash for a PHP webshell observed in related activity, underscoring the need to patch exposed devices and review management-plane access controls.
Sep 3, 2026
Palo Alto Networks disclosed **CVE-2025-0108**, an authentication bypass flaw in the PAN-OS management web interface, and related reporting shows attackers quickly began probing and exploiting exposed systems. MBSD-SOC said it observed attack attempts starting on 2025-02-14, just two days after public disclosure, and linked the activity to exploitation of both **CVE-2025-0108** and the management interface file-read issue **CVE-2025-0111**. The attacks targeted PAN-OS versions across the `11.1`, `10.2`, and `10.1/11.2` branches, with public proof-of-concept code already available. Observed attack traffic was led by sources in **France**, with additional activity from the **United States, Japan, Russia, and Germany** during February and March 2025. MBSD-SOC published an example HTTP request used to attempt authentication bypass against the web management interface and urged organizations to update affected firewalls immediately to the latest fixed PAN-OS releases, as internet-facing management interfaces remain a high-value target for opportunistic exploitation.
Aug 15, 2026
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026