Yes. CISA added CVE-2025-0108 to its Known Exploited Vulnerabilities catalogue on 18 February 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. Any organisation running the affected product should treat remediation as urgent.
How to tell whether PAN-OS exploitation is happening in practice
For a question like this, the useful answer is not whether the CVE exists, but whether there is verified exploitation activity that should change your response speed. CISA’s KEV listing is the practical signal to treat the issue as active, while vendor guidance remains the place to confirm exact affected exposure and remediation steps for your environment. For edge devices, management-plane weaknesses are especially sensitive because they sit directly on the path to administrative control.
When an authentication bypass affects a management web interface, the first question is whether that interface is reachable in the first place, especially from untrusted networks. A public-facing admin plane turns a single flaw into a fleet-level exposure, because the attacker does not need prior access to exploit the weakness. Use the Edge Device Security Guide to anchor your review of management exposure, logging, and hardening.
Do not wait for proof of abuse before treating the device as high priority. For internet-facing appliances, confirmed exploitation in the wild usually means the short path is patching or compensating control first, then checking for signs of compromise. The right operational response is shaped by reachability, privilege level, and whether the management plane can be isolated while remediation is underway.
What the bypass changes for defenders
An authentication bypass on a security appliance is different from a generic software bug because it can erase the trust boundary around administration. If the vulnerable interface controls firewall policy, VPN settings, logging, or system configuration, a successful attacker may be able to alter the device, reduce visibility, or prepare follow-on access. That makes the flaw not just a patching issue, but a control-plane integrity issue.
This is also why edge-device exploitation often becomes a pivot point rather than an end state. Once an attacker can reach the management plane, they may be able to create persistent access, manipulate routes or policies, and mask later activity. That is why emergency triage guidance for Zero-Day and Exploited Vulnerabilities Guide is relevant here, especially the focus on KEV-driven prioritisation and post-patch verification.
If your organisation already has a mature vulnerability process, this kind of issue is where that process should accelerate, not slow down. The question is less “Is there a patch ticket?” and more “Can this exposed management plane still be reached, abused, or reused before we rotate the operational assumptions around it?”
What to check before you call it contained
Containment should include both exposure review and compromise review. Confirm whether the management interface was exposed externally, whether any administrative credentials or sessions were valid during the affected window, and whether the device shows unexpected configuration changes, new admin accounts, altered logging, or disabled protections. If the appliance is part of a broader access path, review adjacent identity and session material as well.
For incident handling, log review matters even when the device vendor says exploitation is possible or known. If logs are incomplete, assume the attacker may have left fewer traces than on a general-purpose host. The practical standard is to look for changes in configuration state, not just failed logins, because an authentication bypass can produce access without the normal authentication breadcrumbs.
When a management-plane flaw is already in active exploitation, validation after patching is as important as the patch itself. Confirm that remote administration is still restricted, that access control paths were not broadened during emergency work, and that the device is not silently carrying forward altered settings from the compromise window.
Risk and Threat Considerations
Internet-facing network appliances are high-value targets because they combine reachability, administrative control, and long-lived trust. When an authentication bypass is actively exploited, the main risk is not just unauthorized login, but full control-plane compromise, which can lead to policy changes, traffic interception, persistence, and loss of visibility.
Failure mechanism: An attacker abuses the management web interface to skip normal authentication, then uses the resulting administrative access to change device configuration, create persistence, or reduce detection.
Impact: The organisation may lose control of the appliance, expose internal traffic paths, and inherit a compromise that survives until configuration review, credential review, and log review are complete.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid triage and remediation central. |
| Recommendation — Prioritise KEV-listed exposures for immediate remediation and verification. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | A known exploited appliance flaw requires prompt remediation and validation. |
| AC-17 — Remote Access | The issue concerns an internet-reachable management interface with privileged access. | |
| Recommendation — Remediate the flaw quickly and verify the fix on exposed devices. Restrict and monitor remote administrative access to the appliance. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | The subject is an exploited technical vulnerability needing urgent treatment. |
| Recommendation — Track, prioritise and remediate the vulnerability under formal vulnerability management. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | An exposed management web interface is the attack surface for the bypass. |
| Recommendation — Hunt for exploitation attempts against the exposed management interface. | ||
Practitioner Guidance
What to prioritise: Treat externally reachable management interfaces as the first containment boundary. If the appliance is exposed, prioritise isolation, patching or mitigation, and a quick review of configuration integrity before lower-severity infrastructure work.
What to verify: Confirm whether administrative access was reachable from the internet or a broader trust zone, whether emergency changes were made during response, and whether the device still behaves as expected after remediation. If logs are sparse, rely more heavily on configuration diffing and control-plane review.
Decision rule: If the affected PAN-OS instance is exposed and cannot be remediated immediately, treat it as a potential compromise candidate until you have checked for unauthorized configuration changes, account changes, and unexpected remote access paths.
Practitioner takeaway: For an actively exploited management-plane bypass, the urgent question is not only whether the vendor has fixed it, but whether the appliance can still be trusted as an admin boundary after exposure.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org