[HIGH PRIORITY] Palo Alto PAN-OS Authorization Bypass (CVE-2025-0108)

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-0108 is an authorization bypass in Palo Alto PAN-OS management and dataplane paths. Attackers bypass security policies on unpatched firewalls — critical for perimeter Linux/Windows networks behind PAN devices.

Affected PAN-OS

• PAN-OS 11.2 before 11.2.4-h4
• PAN-OS 11.1 before 11.1.6-h1
• PAN-OS 10.2 before 10.2.13-h3
• GlobalProtect and SSL decryption enabled environments

Verify version

> show system info | match sw-version
> show system state | match cfg

Patching Method

1. Download fixed PAN-OS content/software from Palo Alto support portal.
2. Export running config baseline before change.
3. Install via Device → Software in HA-aware order (passive first).
4. Reboot if required; validate policy commit succeeds post-upgrade.
5. Diff running config against baseline for unauthorized rule changes.
6. Review traffic logs for policy bypass indicators after patch date.

> show system info | match sw-version
> show config diff running-config saved-config
> show admins all

Until patched

• Apply Palo Alto Threat Prevention temporary mitigation if published
• Restrict management plane to OOB network
• Increase logging on deny→allow policy anomalies