---
title: "CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability"
url: https://erroneo.us/security/cve/CVE-2025-0111/
description: "CVE-2025-0111 (Palo Alto Networks PAN-OS): Exploited in the wild (CISA KEV). An authenticated file read vulnerability in the Palo Alto Networks PAN-OS…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-02-12
date_modified: 2026-02-26
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-0111"
kev: true
cvss: 7.1
epss: 0.01999
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Palo Alto Networks PAN-OS. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-02-20, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-03-13 ; treat that as the outer limit, not the target.
- EPSS 2.0% , percentile 81: FIRST’s model estimates a 2.0% chance of exploitation activity in the next 30 days, higher than 81% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.

## What it is

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.

## Affected products (CVE record)

- Palo Alto Networks Cloud NGFW: see advisory
- Palo Alto Networks PAN-OS: 10.1.0 < 10.1.14-h9, 10.2.0 < 10.2.7-h24, 11.1.0 < 11.1.6-h1, 11.2.0 < 11.2.4-h4
- Palo Alto Networks Prisma Access: see advisory

## Severity

- palo_alto CVSS 4.0: 7.1 `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red`
- palo_alto CVSS 4.0: 5.9 `CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber`

## Exploitation

- CISA KEV: added 2025-02-20; federal due date 2025-03-13. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 2.00% probability of exploitation activity in the next 30 days; percentile 81.

## Sources

- [security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2025-0111)
- [CVE.org record CVE-2025-0111](https://www.cve.org/CVERecord?id=CVE-2025-0111)
- [NVD entry CVE-2025-0111](https://nvd.nist.gov/vuln/detail/CVE-2025-0111)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0111)

---
Source page: https://erroneo.us/security/cve/CVE-2025-0111/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt