PAN-OS Management Interface File Read Vulnerability (CVE-2025-0111)

Historical catalog analysis: CISA added this entry on February 20, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-0111 is an external control of file name or path vulnerability (CWE-73) affecting Palo Alto Networks PAN-OS. The flaw allows an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem. Specifically, the attacker can access any files that are readable by the “nobody” user.

Exposure and applicability

This vulnerability applies to PAN-OS deployments where the management web interface is accessible over the network. The attack vector requires two prerequisites:
1. Network Access: The attacker must be able to reach the management web interface.
2. Authentication: The attacker must possess valid credentials to authenticate to the interface.

Infrastructure owners should identify all PAN-OS instances where the management plane is exposed to untrusted or broad internal networks, as this increases the likelihood of an authenticated actor reaching the vulnerable interface.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog on February 20, 2025, remediation should be prioritized for assets with high-value data residing on the filesystem. Our analysis suggests the following priority sequence:

1. Apply Vendor Mitigations: The primary corrective action is to apply the mitigations provided by Palo Alto Networks.
2. Restrict Management Access: As a compensating control, limit network access to the management web interface to a small set of trusted administrative IP addresses or a dedicated management VLAN. This reduces the attack surface by preventing unauthorized network access even if credentials are compromised.
3. Credential Audit: Review and rotate credentials for accounts with access to the management interface to reduce the risk of authenticated exploitation.

How to validate remediation

Verification must go beyond a simple version check, as software updates do not always guarantee that configurations are secure or that mitigations were applied correctly across all clusters. To verify exposure reduction:

• Configuration Audit: Confirm through system logs or configuration files that the management interface is restricted to authorized source IPs.
• Vendor-Specific Validation: Follow Palo Alto Networks’ official documentation to confirm the mitigation is active and functioning as intended on the specific PAN-OS version in use.
• Access Testing: From a non-authorized network segment, verify that the management web interface is unreachable, confirming the effectiveness of network-level compensating controls.

Limits and open questions

While the vulnerability allows reading files accessible to the “nobody” user, it remains unknown whether this can be leveraged for further privilege escalation or if it has been utilized in specific ransomware campaigns. Additionally, the exact list of sensitive files readable by the “nobody” user is not explicitly detailed in the source; therefore, defenders must assume any file with broad read permissions could be compromised. Residual risk remains if authenticated users are not strictly monitored and managed via multi-factor authentication (MFA) or similar controls.

Source and editorial note

CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability · Source date: February 20, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 23, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 24, 2026 at 00:19 UTC.

Request a Vulnerability Assessment