Attackers Exploit Palo Alto Zero-Day Authentication Bypass

Attackers have stepped up efforts to exploit a vulnerability in the software that runs Palo Alto Networks firewall appliances that could give them direct access to the underlying software.

See Also: From Data Security Blind Spots to Recovery: Close Your Cyber Resilience Gaps

Palo Alto on Wednesday first detailed the authentication bypass vulnerability, assigned CVE-2025-0108, in its PAN-OS operating system. The vulnerability “enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts,” Palo Alto said. “While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.”

Threat intelligence service GreyNoise, which runs honeypots to monitor malicious activity, on Thursday reported seeing “active exploitation” of the flaw. “This high-severity flaw allows unauthenticated attackers to execute specific PHP scripts, potentially leading to unauthorized access to vulnerable systems.”

The Shadowserver Foundation reported seeing a surge in attacks hit its honeypots, starting Thursday. The organization on Friday reported seeing about 3,500 PAN-OS management interfaces exposed to the internet, predominantly in Asia and North America, which remain at risk unless they’ve been patched. “Please make sure to take your management interface off the public internet,” it said in a post to social network Mastodon.

The attack attempts are the latest reminder that edge devices – including routers, virtual private network appliances and other hardware – remain a top target for attackers. Researchers continue to link such exploit attempts to criminal organizations and nation-state groups (see: Edge Devices Face Surge in Mass Brute-Force Password Attacks).

Palo Alto Networks said CVE-2025-0108 is present in multiple versions of PAN-OS 10.1, 10.2, 11.1 and 11.2, and released updated versions of each to patch the vulnerability, as well as a warning that anyone with devices still using PAN-OS 11.0 should upgrade to a supported version that has the fix, since this version reached “end of life” on Nov. 17, 2024, and is no longer receiving updates.

The vendor said the flaw doesn’t exist in its cloud-native Cloud Next-Generation Firewall – aka NGFW – or its Prisma Access firewall as a service.

Credit for discovering the vulnerability goes to Australian attack surface management startup AssetNote – which was recently acquired by Searchlight Cyber – which traced how authentication management requests to PAN-OS get handled by three separate components: the open-source web servers Nginx – “engine X” – and Apache, and also the PHP application. Due to how these requests get handled and passed along, including “some weird path processing behavior” by Apache, an attacker can create “a full authentication bypass in the PAN-OS management interface,” Adam Kues, a security researcher at AssetNote, said in a Wednesday blog post timed to coincide with Palo Alto releasing patches for the “zero-day flaw.”

All internet-exposed PAN-OS management interfaces are at risk. “Organizations relying on PAN-OS firewalls should assume that unpatched devices are being targeted and take immediate steps to secure them,” GreyNoise said.

The risk posed by the vulnerability “is greatest if you enabled access to the management interface from the internet or any untrusted network,” Palo Alto said.

Restricting management web interface access to trusted IP addresses features on a list of best practices from Palo Alto, unchanged since 2022, for securing management interfaces.

The vendor also recommends always using a dedicated VLAN to isolate the management interface for all networking devices, to help restrict their access to administrators only; using a jump box or jump server – referring a server through which all access to admin interfaces must first travel, in part to facilitate better auditing – as well as restricting access to approved IP addresses, and requiring that all connections use secure communications – namely SSH or HTTPS.