Grey Noise Observes Active Exploitation of PAN-OS Authentication Bypass Vulnerability (CVE-2025-0108)
Summary: GreyNoise reports it has confirmed active exploitation attempts against CVE-2025-0108, a high-severity authentication bypass in Palo Alto Networks PAN-OS that lets unauthenticated attackers execute specific PHP scripts and potentially gain unauthorized access. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
Bottom line: An unauthenticated bypass in the firewall at the network edge means an unpatched PAN-OS device is a target now, not after the next patch cycle - GreyNoise's guidance is to assume unpatched devices are already being probed.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-0108
- Related
- CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Feb 18, 2025Storm Watch | Cyber Podcast | The Untold Stories: North Korean Hacks, Exploited Vulnerabilities & Cybersecurity Legends Cyber Risks ·Noise Letter February 2025 Cyber Risks ·