CVE-2025-0124: PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

Severity: low (CVSS 3.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-11 · updated 2026-06-17
Weakness: CWE-73

Description

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.

Affected products

Palo Alto Networks PAN-OS: from 10.1.0 before 10.1.14; from 10.2.0 before 10.2.10; from 11.0.0 before 11.0.6; from 11.1.0 before 11.1.5; from 11.2.0 before 11.2.1; 10.1.14-h1, 10.1.14-h10, 10.1.14-h2, 10.1.14-h3, 10.1.14-h4, 10.1.14-h5 (+4) — fixed in 10.1.14, 10.2.10, 11.0.6, 11.1.5, 11.2.1
Palo Alto Networks Cloud NGFW: all versions
Palo Alto Networks PAN-OS: from 11.2.0 before 11.2.1; from 11.1.0 before 11.1.5; from 11.0.0 before 11.0.6; from 10.2.0 before 10.2.10; from 10.1.0 before 10.1.14-h11 — fixed in 11.2.1, 11.1.5, 11.0.6, 10.2.10, 10.1.14-h11

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.1.14, 10.2.10, 11.0.6, 11.1.5; Palo Alto Networks PAN-OS 11.2.1, 11.1.5, 11.0.6, 10.2.10. Check the vendor advisory for mitigations.

References

https://security.paloaltonetworks.com/CVE-2025-0124

Get alerted when CVE-2025-0124 or the next vulnerability affects your stack