Riskcovery

CVE-2025-4615

PAN-OS: Improper Neutralization of Input in the Management Web Interface

State
Published
Severity
5.4 Medium
Published
Oct 9, 2025
Updated
Apr 1, 2026
Reserved
May 12, 2025

Read the record on cve.org

Description

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Scores

CVSSScoreVectorSource
4.05.4 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/AU:N/R:U/V:D/RE:M/U:Amberpalo_alto
4.05.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/AU:N/R:U/V:D/RE:M/U:Amberpalo_alto

Weaknesses

  • CWE-83 Improper Neutralization of Script in Attributes in a Web Page

Affected Products

ProductVersions
Cloud NGFWPalo Alto Networks
  • AllNot affected
PAN-OSPalo Alto Networks
  • 12.1.0Not affected
  • 11.2.0 to before 11.2.8Affectedfrom 11.2.8Not affected
  • 11.1.0 to before 11.1.4-h27Affectedfrom 11.1.10-h7Not affectedfrom 11.1.6-h21Not affectedfrom 11.1.4-h27Not affected
  • 10.2.0 to before 10.2.17Affectedfrom 10.2.17Not affected
Prisma AccessPalo Alto Networks
  • AllNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.