Loading vulnerability…
Authenticated file read in Palo Alto Networks PAN-OS
CVE-2025-0111 is an authenticated file-read vulnerability in the Palo Alto Networks PAN-OS management web interface. An authenticated attacker with network access to this interface can read files on the PAN-OS filesystem that are accessible to the “nobody” user, potentially exposing sensitive data. Cloud NGFW and Prisma Access are not affected. Active exploitation has included chaining this vulnerability with CVE-2025-0108 and CVE-2024-9474.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes the contents of PAN-OS filesystem files readable by the “nobody” user, potentially disclosing sensitive information. Exploit chains combining CVE-2025-0111 with the authentication bypass CVE-2025-0108 and privilege escalation CVE-2024-9474 have been reported to provide full device control, including root access; those broader capabilities are not established for CVE-2025-0111 alone.
If you can’t patch tonight, do this now.
Restrict management web interface access to trusted internal IP addresses and remove direct internet exposure. Increase monitoring and detection for suspicious management-interface activity and exploitation attempts involving CVE-2025-0111 and related exploit chains.
Patch, then assume compromise.
Upgrade affected PAN-OS installations to a fixed release: 10.1.14-h9, 10.2.13-h3, 11.1.6-h1, or 11.2.4-h4, or a later fixed release in the corresponding branch. Prioritize patching because exploitation has been observed. Investigate potentially compromised devices separately, as installing updates does not remediate an existing compromise.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.