CVE-2025-0108 Detection: Active Exploitation of an Authentication Bypass Palo Alto Networks PAN-OS Software - SOC Prime

The recent CVE-2025-0108 vulnerability in Palo Alto Networks’ PAN-OS allows unauthorized access to the management interface and execution of PHP scripts, posing significant risks despite not enabling remote code execution. There’s a growing trend of exploit attempts, and security professionals are urged to enhance their defenses. Affected: Palo Alto Networks PAN-OS

Keypoints :

Palo Alto Networks PAN-OS has a critical firewall flaw, CVE-2025-0108, allowing authentication bypass.
The vulnerability allows execution of specific PHP scripts but does not enable remote code execution.
A notable increase in cyber-attacks leveraging vulnerabilities was reported, with an average of 115 CVEs disclosed daily by late 2024.
There is a combined threat from CVE-2025-0108 with other CVEs, requiring prompt defender responses.
SOC Prime Platform offers tools for detecting and responding to exploitation attempts effectively.
Patch updates have been released for affected PAN-OS versions to mitigate this vulnerability.

Full Story: https://socprime.com/blog/detect-cve-2025-0108-exploitation/

Tags: EXPLOIT, SOC, THREAT HUNTING, INITIAL ACCESS, VULNERABILITY, EDR, PATCH, SIEM

CVE-2025-0108 Detection: Active Exploitation of an Authentication Bypass Palo Alto Networks PAN-OS Software – SOC Prime