The American cybersecurity company, Palo Alto Networks, has warned that hackers are exploiting a new vulnerability in its firewall software to infiltrate the networks of customers who have not applied the necessary patches.
The attackers are taking advantage of a recently discovered flaw in PAN-OS, the operating system used by Palo Alto Networks’ firewalls, as confirmed by the California-based company this Tuesday.
The vulnerability, identified as CVE-2025-0108, was initially detected by the cybersecurity firm Assetnote earlier this month while investigating two previous flaws in Palo Alto’s firewalls that had already been used in prior attacks.
Palo Alto Networks issued an alert the same day and urged its customers to apply the corresponding patches immediately. This Tuesday, the company updated its statement to report that the vulnerability is being actively exploited.
The company explained that attackers are combining this new vulnerability with two previously identified flaws, CVE-2024-9474 and CVE-2025-0111, to target the web management interfaces of PAN-OS that lack the appropriate patches and security measures. CVE-2024-9474 has been used in attacks since November 2024, as previously reported.
Although Palo Alto Networks has not detailed how hackers are linking these three vulnerabilities, it has noted that the complexity of the attack is “low.”
The scale of the exploitation is still unknown, but the threat intelligence startup GreyNoise stated in a blog post this Tuesday that it has detected 25 IP addresses actively exploiting the PAN-OS vulnerability, compared to just two IP addresses on February 13, suggesting an increase in malicious activity. GreyNoise has classified these exploitation attempts as “malicious,” indicating they are being carried out by threat actors rather than security researchers.
“This high-severity flaw allows unauthenticated attackers to execute specific PHP scripts, which could result in unauthorized access to vulnerable systems,” GreyNoise explained.
According to GreyNoise, the highest levels of attack traffic have been observed in the United States, Germany, and the Netherlands.
So far, it is unknown who is behind these attacks or whether sensitive information has been stolen from customer networks. Palo Alto Networks has not immediately responded to inquiries from TechCrunch.
Meanwhile, CISA, the U.S. government’s cybersecurity agency, added Palo Alto’s latest vulnerability to its public catalog of known exploited vulnerabilities (KEV) this Tuesday.
By: Nestor Castillo, ForAllTechNews Director
Image credit: Wikimedia Commons / CC0 1.0 / CC0 1.0 Universal