CVE-2025-0111
Published 2025-02-12 · Updated 2026-06-17 · Source psirt@paloaltonetworks.com
Summary
CVE-2025-0111 is a medium-severity (CVSS 6.5) vulnerability in Palo Alto Networks PAN-OS. CISA added it to the Known Exploited Vulnerabilities catalog on February 20, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 13, 2025. CISA does not currently list it as used in ransomware campaigns. Palo Alto Networks has 16 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.
All 16 known-exploited Palo Alto Networks vulnerabilities →Description
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Palo Alto Networks — PAN-OS
Name: Palo Alto Networks PAN-OS File Read Vulnerability
Date added: 2025-02-20 · Due: 2025-03-13
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.