CVE-2025-0124PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface

Description

An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.

Timeline

Scores

EPSS (exploitation in 30 days)

0.36% · top 70% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Affected products

• Palo Alto Networks · Cloud NGFW

  • affected All

• Palo Alto Networks · PAN-OS

  • affected 11.2.0 – < 11.2.1
  • affected 11.1.0 – < 11.1.5
  • affected 11.0.0 – < 11.0.6
  • affected 10.2.0 – < 10.2.10
  • affected 10.1.0 – < 10.1.14-h11

• Palo Alto Networks · Prisma Access

  • unaffected All

What to do

Solution: Version Minor Version Suggested Solution PAN-OS 11.2 11.2.0 Upgrade to 11.2.1 or laterPAN-OS 11.111.1.0 through 11.1.4Upgrade to 11.1.5 or laterPAN-OS 11.011.0.0 through 11.0.5Upgrade to 11.0.6 or laterPAN-OS 10.210.2.0 through 10.2.9Upgrade to 10.2.10 or laterPAN-OS 10.110.1.0 through 10.1.14Upgrade to 10.1.14-h11 or laterAll other older unsupported PAN-OS versions  Upgrade to a supported fixed version PAN-OS 11.0 has reached EoL. We listed it here for completeness because a patch for PAN-OS 11.0 was released before it reached EoL. If you are still using any vulnerable EoL versions, we strongly recommend that you upgrade to a supported fixed PAN-OS version.

Workaround: Recommended mitigation—The vast majority of firewalls already follow Palo Alto Networks and industry best practices. However, if you have not already, we strongly recommend that you secure access to your management interface according to our https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 * Palo Alto Networks official and detailed technical documentation: https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-15137 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-0124](https://cveledger.app/badge/CVE-2025-0124.svg)](https://cveledger.app/cve/CVE-2025-0124)

Record last updated 11 Apr 2025, 16:02 UTC.