Hackers Chain Exploits of Three Palo Alto Networks Firewall Flaws – Source: www.infosecurity-magazine.com

Hackers are actively trying to simultaneously exploit three vulnerabilities in unpatched Palo Alto Networks firewall appliances.

These flaws, all affecting Palo Alto’s PAN-OS web management interface, include CVE-2025-0108, an authentication bypass, CVE-2025-0111, an authenticated file read vulnerability, and CVE-2024-9474, a privilege escalation vulnerability.

The first two are high-severity vulnerabilities, with CVSS scores of 8.8 and 7.1, respectively. Palo Alto disclosed the vulnerabilities and published patches for both flaws on February 12, 2025.

The third is a slightly less severe with a CVSS score of 6.9 and is an older flaw, with a fix released in November 2024.

First detected by cyber threat intelligence organizations, the chain exploit was acknowledged by Palo Alto on February 19.

Increasing PAN-OS Firewall Flaws Exploits

Researchers at Assetnote, who first detected CVE-2025-0108 , published a proof-of-concept exploit on February 12 showing how the flaw could be chained together with CVE-2024-9474 to gain root privileges on unpatched PAN-OS firewalls.

In the following days, several organizations, including network threat intelligence firm GreyNoise and the non-profit Shadowserver Foundation, reported that threat actors had begun actively exploiting the flaw, with attempts coming from two IP addresses.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-0108 to its Known Exploited Vulnerabilities (KEV) catalog on February 18.

The next day, Palo Alto updated its advisories for CVE-2025-0108 and CVE-2025-0111. It added that it “has observed exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111 on unpatched and unsecured PAN-OS web management interfaces.”

The software provider did not provide details on the exploit chain but said the complexity of the attack was “low.” 

GreyNoise has observed an increase in IP addresses targeting CVE-2025-0108, rising from two on February 13 to 25 five days later.

The primary sources of these attacks are in the US, Germany and the Netherlands, but this doesn’t necessarily reflect the attackers’ actual locations.

“Organizations relying on PAN-OS firewalls should assume that unpatched devices are being targeted and take immediate steps to secure them,” the GreyNoise researchers warned.

Photo credits: viewimage/Tada Images/Shutterstock

Read now: China-Linked Espionage Tools Used in Recent Ransomware Attack