--- id: "CVE-2025-0111" kind: "vulnerability" aliases: ["CVE-2025-0111"] title: "paloaltonetworks pan-os: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker\u2026" severity: "high" cvss: 7.1 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Palo Alto Networks PAN-OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.1.14"], "affected": ">= 10.1.0, < 10.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.2.7"], "affected": ">= 10.2.0, < 10.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.2.12"], "affected": ">= 10.2.10, < 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.1.6"], "affected": ">= 11.0.0, < 11.1.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["11.2.4"], "affected": ">= 11.2.0, < 11.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.13", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "firewalls", "infrastructure", "palo-alto", "pan-os", "self-hosted"] not_affected_if: ["auth-required", "no-management-interface-exposure"] published_at: "2025-02-12T21:15:16+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:05+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0111", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0111", "first_seen_at": "2026-10-23T22:29:05+00:00"}] --- # paloaltonetworks pan-os: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker… Palo Alto Networks PAN-OS, the firewall operating system, has a file read flaw in its management web interface. An attacker with valid login to that interface can read files the nobody user can access on the device. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Palo Alto Networks PAN-OS affected ? fixed ? - vendor:paloaltonetworks pan-os affected >= 10.1.0, < 10.1.14 fixed 10.1.14 - vendor:paloaltonetworks pan-os affected >= 10.2.0, < 10.2.7 fixed 10.2.7 - vendor:paloaltonetworks pan-os affected >= 10.2.10, < 10.2.12 fixed 10.2.12 - vendor:paloaltonetworks pan-os affected >= 11.0.0, < 11.1.6 fixed 11.1.6 - vendor:paloaltonetworks pan-os affected >= 11.2.0, < 11.2.4 fixed 11.2.4 - vendor:paloaltonetworks pan-os affected = 10.1.14 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.7 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.8 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.9 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.12 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.13 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.6 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.4 fixed ? ## Fix Apply the mitigations or fixed PAN-OS release per the vendor advisory; if none are available, discontinue use of the product per CISA. Affected and fixed versions: unknown from sources. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0111 - 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-0111 ## From the sources An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_