Armis Named a Leader in the 2025 Gartner® Magic Quadrant™ for CPS Protection Platforms

Read More
Back /
Request a demo
|
Request a Demo

Breaking Down Palo Alto Networks PAN-OS Vulnerability

early warning alert
Early Warning

Introduction

A recently discovered vulnerability, CVE-2025-0108, found in Palo Alto Networks firewalls, is being actively exploited by threat actors. This new vulnerability is being used in conjunction with two previously identified flaws, CVE-2024-9474 and CVE-2025-0111, to create a potent exploit chain. This chained attack allows remote attackers to gain unauthorized, root-level access to PAN-OS firewall appliances, effectively giving them complete control over the affected systems.

Security researchers have issued warnings that threat actors began exploiting this vulnerability chain within days of Palo Alto releasing a patch for CVE-2025-0108 (February 12, 2025), highlighting the critical need for organizations to apply the patch as soon as possible. Unpatched devices are at high risk of compromise, and given the speed with which threat actors have moved to exploit this chain, it is likely that attacks will continue to increase in frequency.

The severity of this exploit chain is underscored by the fact that it grants root-level access, the highest level of privilege on a system. This level of access allows attackers to perform any action on the compromised device, including stealing sensitive data, installing malware, disrupting operations, and using the device as a springboard for attacks on other systems within the network.

Organizations that use Palo Alto Networks firewalls are strongly urged to apply the patch for CVE-2025-0108 immediately to mitigate the risk of compromise. Additionally, it is recommended that organizations review their network security posture and implement additional security measures, such as intrusion detection and prevention systems, to detect and block attacks that exploit this and other vulnerabilities.

Critical CVEs in the Palo Alto Vulnerability Chain

The exploit chain consists of three distinct vulnerabilities in PAN-OS, Palo Alto Networks’ firewall operating system. Each plays a role in the multi-step attack:

  • CVE-2025-0108 (Authentication Bypass)1: A high-severity flaw (CVSS of 8.8) in the PAN-OS web management interface that allows an unauthenticated attacker with network access to bypass login controls and invoke privileged backend PHP scripts. Exploiting this bug effectively lets the attacker act as an administrator on the firewall’s management interface, undermining normal authentication. Palo Alto marked this issue “Highest” urgency due to its ease of exploitation and serious impact on device integrity.
  • CVE-2024-9474 (Privilege Escalation)2: A previously disclosed PAN-OS vulnerability (CVSS of 6.9) that enables a user with administrator-level access to execute OS-level commands with root privileges. In essence, an attacker who has admin access to the web interface can escalate to full root control of the firewall’s underlying operating system. Notably, this flaw was exploited as a zero-day in 2024 before a patch was released in November 2024 highlighting its attractiveness to attackers. Armis had the CVE-2024-9474 added to the Early Warning in November last year.
  • CVE-2025-0111 (File Read Vulnerability)1: A high-severity file read bug (CVSS 7.1) in PAN-OS that allows an authenticated attacker to read arbitrary files on the firewall’s file system accessible by the low-privileged “nobody” account. In practice, an attacker who has gained any foothold on the device (such as via the Web interface) could exploit this to steal sensitive information stored in configuration or system files. Palo Alto disclosed and patched this issue on February 12, 2025 alongside CVE-2025-0108.

“Left of Boom” Approach to Stop the Chain from Being Successfully Exploited

Threat actors are actively leveraging a dangerous exploit chain to gain unauthorized, root-level control of PAN-OS firewall appliances. The attack uses three vulnerabilities in the chain; if you can stop one of those vulnerabilities from happening, the exploit is blocked. In the chain, Armis Centrix™ for Early Warning blocked CVE-2024-9474 within days of Palo Alto’s patch release which stopped the attack in its tracks.

Armis Centrix™ added CVE-2024-9474 to the Early Warning list in November 2024. The CVSS score is 6.9, which most people wouldn’t have patched. Early Warning entries are all treated as critical, so Early warning customers would have patched this and effectively stopped the chain.

Armis Centrix™ for Early Warning provides a “left of boom” approach to empower organizations with early warning intelligence to effectively anticipate and mitigate cyber risk. By leveraging AI-driven actionable intelligence, Armis Centrix™ provides insights into vulnerabilities that threat actors are exploiting in the wild or are about to weaponize, allowing organizations to understand their impact and take preemptive action.

Attack Vectors and Exploit Chain Details

In an observed attack scenario, adversaries chain these vulnerabilities to achieve a full compromise of the firewall. The attack unfolds in stages:

  1. Initial Breach via Auth Bypass (CVE-2025-0108): the attacker first targets the firewall’s management Web interface, which by default listens on HTTPS (port 443 or 4443 for GlobalProtect portals). By sending specially crafted HTTP requests that exploit a path confusion between Nginx and Apache on the device, the attacker can bypass authentication checks. This grants unauthenticated access to protected functionalities of the system, essentially tricking it into treating the attacker as an authenticated admin. The vulnerability permits direct access to specific admin PHP scripts, providing an initial entry point into the management interface without requiring valid credentials.
  2. Privilege Escalation to Root-Level Access (CVE-2024-9474): with administrative access obtained in step 1, the attacker can next leverage the privilege escalation flaw to break out of the web interface confines. CVE-2024-9474 lets a PAN-OS administrator execute system-level commands with root privileges. In practice, the attacker triggers this bug (for example, by abusing a feature in the management interface that improperly passes input to the underlying OS) to escalate from admin-level access to full root access on the firewall. This yields complete control over the device’s operating system. At this point, the attacker can run arbitrary commands on the firewall, install malware, or modify system files at will.
  3. Data Exfiltration or Stealth via File Read (CVE-2025-0111): armed with root access, an attacker already has total control; however, they may also exploit the file read vulnerability to quietly harvest sensitive data from the device. CVE-2025-0111 allows reading of configuration files, logs, or credential stores that are accessible to the “nobody” service account. For example, attackers could retrieve configuration backups, password hashes, VPN keys, or session tokens stored on the firewall. This information might be used to facilitate further lateral movement or maintain persistence. Even if the privilege escalation step is mitigated on a target system, an attacker could chain the auth bypass (0108) with this file-read flaw (0111) to steal data and potentially find other paths to deepen access. Palo Alto Networks has observed threat actors combining all three bugs in real-world attacks against unpatched devices.

Security researchers at Assetnote, who discovered CVE-2025-01084, demonstrated a working proof-of-concept that chains the authentication bypass with the privilege escalation to rapidly gain root on vulnerable PAN-OS firewalls.Within a day of Palo Alto’s disclosure and patch release, threat intelligence firms reported active scanning and exploitation attempts in the wild. GreyNoise, for instance, observed multiple attackers beginning to target CVE-2025-0108 on internet-exposed firewalls just 24 hours after the fix was announced5. By the following week, at least 25 distinct malicious IP addresses were seen aggressively exploiting the auth bypass flaw often in combination with the older vulnerabilities to maximize impact. This rapid weaponization underscores the importance of swift patching and layered defenses, as attackers waste no time adopting public exploits.

Impact on Affected Systems

The consequences of this exploit chain are severe. Successfully chaining these vulnerabilities gives an attacker full control of the targeted firewall, effectively turning the organization’s perimeter defense into a beachhead for further intrusion. Key impacts include:

  • Root-Level Compromise: once CVE-2025-0108 and CVE-2024-9474 are exploited in tandem, the attacker achieves root access on the firewall. This means the adversary can execute arbitrary commands, install persistent malware or backdoors, and completely manipulate the firewall’s operation. They could disable security controls or modify firewall rules to create stealthy tunnels, allowing other malware or attackers to slip into the network undetected.
  • Network Traffic Interception and Tampering: with control over the firewall, an attacker can monitor, intercept, or alter traffic passing through it. They might decrypt and steal sensitive data traversing the device, or inject malicious payloads into traffic streams. The firewall, normally a security device, can be turned into a data collection tool for the attacker.
  • Credential and Data Theft: through the file read vulnerability (or simply by using root access), attackers can harvest configuration data and credentials stored on the firewall. Configuration files may contain administrator account hashes, API keys, VPN private keys, or details about connected networks. Palo Alto noted that unauthorized script execution via the auth bypass could “negatively impact the integrity and confidentiality” of the system indicating that sensitive data could be compromised. Stolen credentials or VPN keys could be leveraged to impersonate the firewall or access other systems, extending the breach beyond the firewall itself.
  • Further Internal Compromise: a firewall breach can serve as a launching pad to attack internal assets. The attacker may pivot from the firewall to other hosts by leveraging its position in the network. For example, they could use the firewall to scan internal networks, move laterally, or open ports to communicate with previously isolated systems. Essentially, a compromised firewall turns the network’s defenses inside-out.
  • Service Disruption: attackers with destructive motives could disrupt network operations by altering the firewall’s configuration or firmware. They might wipe device memory, causing a denial-of-service, or lock administrators out of the interface. Even as a byproduct of manipulation, firewall instability or outages could occur, impacting business continuity.

In summary, an organization with an exploited PAN-OS firewall faces both an immediate security collapse at the perimeter and a high likelihood of deeper penetration into critical systems. The firewall can no longer be trusted to enforce policies or protect the network, and all data flowing through it may be exposed. The integrity, confidentiality, and availability of network operations are at stake. This wide impact radius is why these issues are being taken so seriously by security teams and authorities.

Palo Alto Networks’ Response and Patches Availability

Palo Alto Networks moved quickly to address these vulnerabilities once identified. On February 19th, 2025, the company released security advisories and patches for both the new authentication bypass (CVE-2025-0108) and the file read bug (CVE-2025-0111. Updated versions were provided for all affected release tracks: PAN-OS 10.1, 10.2, 11.1, and 11.2. For instance, PAN-OS 10.1.14-h9, 10.2.13-h3, 11.1.6-h1, and 11.2.4-h4 (or later builds) contain the fixes that prevent these exploits.
Palo Alto Networks’ advisories also provided guidance on safeguarding devices in addition to installing updates. Notably, they reiterated that the risk is highest for any firewalls with their management interfaces exposed to the internet

As a precaution, Palo Alto recommended that admins restrict access to the management Web interface to only trusted, internal IP addresses as per best practices. In fact, the company’s guidance suggests using a secure jump-host or VPN such that no direct internet traffic can reach the management port. These measures, combined with the patches, form a two-layer defense: even if a new auth bypass surface in the future, having the interface cordoned off significantly reduces the odds of compromise.

The company’s cloud-delivered firewall services (Prisma Access and Cloud NGFW) were not affected by these on-premises software bugs, but all customers using PAN-OS appliances were strongly advised to upgrade immediately.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also took note, effectively mandating federal agencies to patch these flaws by March 11, 2025.

Mitigation and Best Practices

Organizations using Palo Alto Networks firewalls should take immediate action to mitigate the risk from this exploit chain. Key best practices include:

  • Apply Patches Promptly: update PAN-OS to the fixed versions released by Palo Alto Networks as soon as possible. This is the only way to fully remove the vulnerabilities. Given active attacks, administrators should treat this as an emergency change window rather than waiting for regular maintenance cycles. If running PAN-OS 10.1, 10.2, 11.x or any affected release, upgrade to the latest security patch level without delay.
  • Restrict Management Access: ensure that firewall management interfaces (HTTP/HTTPS, SSH, etc.) are not exposed to the public Internet. Configure access control so that only a small set of trusted internal hosts or a secure jump box can reach the management port. This might involve ACLs, management VLANs, or VPN gateways. By hardening access in this way, even an unauthenticated attack like CVE-2025-0108 cannot be launched directly by external scanners. Palo Alto’s own best practice guidelines strongly advocate limiting management interface access to internal or dedicated networks.
  • Monitor for Suspicious Activity: increase monitoring of firewall logs and network traffic for any signs of exploitation or odd behavior. Indicators might include repeated failed access attempts to the management web interface, unexpected user account changes on the firewall, or strange outbound connections originating from the firewall itself.
  • Validate and Harden Device Configurations: review the firewall’s configuration for any weak points. Disable any unnecessary services on the management interface. Ensure the “Permitted IP addresses” for management are set to known administrators’ systems. If GlobalProtect portal/gateway is in use, double-check that no management profile is attached to those interfaces on port 4443 (as Palo Alto notes GlobalProtect interfaces could otherwise be a path to the management web UI). Removing any inadvertent exposure will reduce the attack surface.

By following the above steps, organizations can significantly lower the likelihood of a successful exploit, even if some time is needed to fully patch all devices. The overarching goal of these mitigations is to “shield” the management interface from external threats and catch any intrusion attempts quickly, thereby breaking the kill-chain that attackers are currently exploiting.

How Enabling Proactive AI-driven Detection by Armis Centrix™ for Early Warning Can Help Detect and Mitigate These Threats

Armis Centrix™, the Armis Cyber Exposure Management Platform, is powered by the Armis AI-driven Asset Intelligence Engine, which sees, protects and manages billions of assets around the world in real time. In the context of the Palo Alto Networks firewall vulnerabilities, Armis Centrix™ offers several relevant capabilities to detect, prevent, and mitigate exploitation:

  • Comprehensive Device Visibility & Risk Assessment: Armis Centrix™ automatically discovers and profiles all devices on the network, including Palo Alto firewalls, without requiring any agent on those devices. It builds an inventory that identifies each device’s make, model, OS, and firmware version. This means security teams can quickly see which firewalls are running vulnerable PAN-OS versions. Armis Centrix™ even assigns a risk score to each device based on factors like known software vulnerabilities). If a firewall in the environment is running a PAN-OS build affected by CVE-2025-0108, CVE-2024-9474, or CVE-2025-0111, Armis Centrix™ will flag it as high-risk, enabling teams to prioritize patching that device before an attacker finds it. Example of customized Armis Standard Query (ASQ) searches are: 
    • in:vulnerabilities id:CVE-2024-9474,CVE-2025-0108,CVE-2025-0111
    • in:devices vulnerabilities:(id:(CVE-2024-9474,CVE-2025-0108,CVE-2025-0111))
  • Continuous Threat Detection on Device Activity: Armis Centrix™ monitors the real-time behavior of devices and network traffic for signs of malicious or anomalous activity. Armis Centrix™ can catch the early indicators of an exploit attempt against a Palo Alto firewall. For example, if an external IP suddenly starts making unusual requests to the firewall’s management interface (potentially attempting the auth bypass), Armis Centrix™ detection engine can recognize this as suspicious behavior. Likewise, if a normally quiet firewall begins sending outbound connections or executing processes atypical for its profile (which might happen if it’s compromised via the exploit chain), rmis Centrix™ would alert on that anomaly. This kind of passive, network-centric monitoring is crucial for devices like firewalls that can’t easily run traditional endpoint security agents.
  • Integration and Automated Response: Armis Centrix™ integrates closely with Palo Alto Networks security infrastructure to enable rapid response against threats. Through its cloud integration with Palo Alto Cortex and direct tie-ins to Palo Alto Next-Generation Firewalls (NGFW), Armis Centrix™ can automatically take action when it detects a threat. For instance, if Armis Centrix™ flags an IP address actively exploiting CVE-2025-0108 against a firewall, it can signal the Palo Alto NGFW to block that IP or quarantine the affected device in real time. This automated blocking of “suspect devices” helps contain the attack before it fully compromises the target. Additionally, Armis Centrix™ integration with Cortex Data Lake means it can enrich Palo Alto’s own logging/monitoring with device context, aiding in incident investigations. Essentially, Armis Centrix™ can serve as an intelligent watcher that not only raises the alarm but also works with Palo Alto’s enforcement points to shut down active threats.
  • Vulnerability and Exposure Management: Using insights from Armis Centrix™ for Early Warning and its global asset intelligence, the platform keeps track of emerging threats and newly disclosed CVEs. This allows customers to be “left of boom” from these threats. By unifying vulnerability data with real-time device status, Armis Centrix™ helps organizations close the window of exposure more efficiently.

In summary, the recent chained vulnerability affecting Palo Alto Networks devices is a stark reminder of the importance of Armis Centrix™ for Early Warning vulnerability intelligence to protect from zero-days and organization muscle to support prompt patching and layered security.

Armis Centrix™ for Early Warning is the proactive cybersecurity solution designed to empower organizations with early warning intelligence to anticipate and mitigate cyber risk effectively. By leveraging AI-driven actionable intelligence, Armis Centrix™ provides insights into the vulnerabilities that threat actors are exploiting in the wild or are about to weaponize, allowing organizations to understand their impact and take preemptive action.

Interested in learning more about Armis Centrix™ for Early Warning? Sign up for a demo today!

Footnotes: