CVE-2025-4615

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Severity: High7.2CVSS 3.1, High
EPSS: 0.79%
Published: 9 Oct 2025
Updated: 17 Jun 2026

Description

Title, description and vendor guidance are quoted from the source records.

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Weakness: CWE-83

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

0.79% probability of exploitation in the next 30 days (percentile 55%).

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the source states, per branch

Versions matched by Patcharo

Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)

Branch	Affected	Fixed in
11.2	>= 11.2.0, < 11.2.8	11.2.8
11.1	>= 11.1.0, < 11.1.4-h27 >= 11.1.5, < 11.1.6-h21 >= 11.1.7, < 11.1.10-h7	11.1.4-h27 11.1.6-h21 11.1.10-h7
10.2	>= 10.2.0, < 10.2.17	10.2.17

Versions not listed are stated unaffected by the vendor.

Workaround / Vendor remediation

Workaround · PAN-OS

No known workarounds exist for this issue.

Vendor remediation · PAN-OS

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW All No action needed. PAN-OS 12.1 No action needed. PAN-OS 11.2 11.2.0 through 11.2.7 Upgrade to 11.2.8 or later. PAN-OS 11.1 11.1.0 through 11.1.4 Upgrade to 11.1.4-h27 or 11.1.6-h21 or 11.1.10-h7 or later. 11.1.4 through 11.1.6 Upgrade to 11.1.6-h21 or 11.1.10-h7 or later. 11.1.8 through 11.1.10 Upgrade to 11.1.10-h7 or later. PAN-OS 10.2 10.2.0 through 10.2.16 Upgrade to 10.2.17 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access All No action needed.

References

https://security.paloaltonetworks.com/CVEN-2025-4615(opens in a new tab)

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Palo Alto Networks (CVE record): Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
NVD: NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS: FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0

Last verified: 28 Sept 2026, 02:31 UTC