Vulnerability in Palo Alto Networks Cloud Ngfw
CVE-2025-0124
An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (25.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Palo Alto Networks Cloud Ngfw — versions All
- Palo Alto Networks Pan-Os — versions 11.2.0, 11.1.0, 11.0.0
- Palo Alto Networks Prisma Access — versions All
- Paloaltonetworks Pan-Os — versions 10.1.14
Weakness classification (CWE)
References
- security.paloaltonetworks.com/CVE-2025-0124 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-0124?
- CVE-2025-0124 is a low-severity vulnerability in Palo Alto Networks Cloud Ngfw, classified under External Control of File Name or Path. CVSS score: 3.8/10. Published 2025-04-11.
- How severe is CVE-2025-0124?
- Low severity. CVSS v3 base score is 3.8 out of 10.