Skip to content
Patcharo
All vulnerabilities
CVE-2025-4615

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Severity
High7.2CVSS 3.1, High
Known exploited
Not listed
Exploit prediction
0.79%
Published
9 Oct 2025Updated 17 Jun 2026 · Last verified 30 Sept 2026

Known remediation

Fixed releases per branch, as the vendor states them. Patcharo never infers a fix.

  • Palo Alto Networks PAN-OS

    Vendor advisory
    • 11.211.2.8
    • 11.111.1.4-h27, 11.1.6-h21, 11.1.10-h7
    • 10.210.2.17

Workaround / Vendor remediation

Workaround · PAN-OS

No known workarounds exist for this issue.

Vendor remediation · PAN-OS

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW All No action needed. PAN-OS 12.1 No action needed. PAN-OS 11.2 11.2.0 through 11.2.7 Upgrade to 11.2.8 or later. PAN-OS 11.1 11.1.0 through 11.1.4 Upgrade to 11.1.4-h27 or 11.1.6-h21 or 11.1.10-h7 or later. 11.1.4 through 11.1.6 Upgrade to 11.1.6-h21 or 11.1.10-h7 or later. 11.1.8 through 11.1.10 Upgrade to 11.1.10-h7 or later. PAN-OS 10.2 10.2.0 through 10.2.16 Upgrade to 10.2.17 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access All No action needed.

Description

Title, description and vendor guidance are quoted from the source records.

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Weakness: CWE-83

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

0.79% probability of exploitation in the next 30 days (percentile 55%).

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the source states, per branch

Versions matched by Patcharo

Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)

BranchAffectedFixed in
11.2
>= 11.2.0, < 11.2.8
11.2.8
11.1
>= 11.1.0, < 11.1.4-h27
>= 11.1.5, < 11.1.6-h21
>= 11.1.7, < 11.1.10-h7
11.1.4-h27
11.1.6-h21
11.1.10-h7
10.2
>= 10.2.0, < 10.2.17
10.2.17

Versions not listed are stated unaffected by the vendor.

References

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Palo Alto Networks (CVE record)
Palo Alto Networks (CVE record) · 30 Sept 2026 at 06:17 UTC · Parser patcharo-cve5/1.1.0
NVD
NVD · 27 Sept 2026 at 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS
FIRST EPSS · 30 Sept 2026 at 00:17 UTC · Parser patcharo-epss/1.0.0

Last verified: 30 Sept 2026 at 06:17 UTC