����������

Palo Alto recently disclosed that PAN-OS firewalls vulnerable to CVE-2025-0111 are being used in exploit chain attacks.

In these attacks, CVE-2025-0111 is chained with CVE-2025-0108 and CVE-2024-9474, for which Palo Alto released patches in February 2025 and November 2024, respectively.

Despite fixes also being released for CVE-2025-0111 in February 2025, Palo Alto updated a previously distributed after observing threat actors chaining it with CVE-2025-0108 and CVE-2024-9474 in exploit attempts on unpatched and unsecured PAN-OS web management interfaces.

Successful exploitation of CVE-2025-0111 allows unauthenticated threat actors with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. Health-ISAC previously released an in which threat actors were chaining CVE-2025-0108 and CVE-2024-9474 to exploit vulnerable PAN-OS firewalls. 

View the detailed report below.