Breaches and incidentsOn CISA KEV
Indian BFSI sector (India): CERT-In/CSIRT-Fin observe exploitation campaign against Palo Alto firewalls
CIAD-2025-0047 (Critical) says CERT-In/CSIRT-Fin saw a surge of attacks on Palo Alto Networks firewalls “particularly those deployed within the BFSI sector...
- Disclosed
- Verification
- Checked against a primary source
What happened
- CIAD-2025-0047 (Critical) says CERT-In/CSIRT-Fin saw a surge of attacks on Palo Alto Networks firewalls “particularly those deployed within the BFSI sector in India” during October 2025, mainly PA-3220 devices running PAN-OS 8.x to 12.x, with systematic scanning and exploitation of known critical CVEs (references include CVE-2025-0108 and CVE-2024-0012).
- Root cause: unpatched PAN-OS and internet-exposed management interfaces.
- Attacker: not named; CERT-In says it matches a global coordinated campaign.
- Response: patch, restrict management to VPN/allow-listed IPs, review GlobalProtect and management-portal logs, MFA for admins.
Am I affected?
CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
| Product | Affected | Not affected |
|---|---|---|
| Palo Alto Networks Cloud NGFW | Not stated | All is not affected |
| Palo Alto Networks PAN-OS | from 11.2.0 before 11.2.4-h1 from 11.1.0 before 11.1.5-h1 from 11.0.0 before 11.0.6-h1 from 10.2.0 before 10.2.12-h2 | 10.1.0 is not affected |
| Palo Alto Networks Prisma Access | Not stated | All is not affected |
- Fixed in: 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2 (versions before these are affected).
- Exploited: yes, on CISA’s Known Exploited Vulnerabilities list since 18 Nov 2024; CISA’s deadline for US agencies was 9 Dec 2024.
- Detection: free a Nuclei template and a Suricata rule from vedas-signatures, explained on the CVE-2024-0012 page.
CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
| Product | Affected | Not affected |
|---|---|---|
| Palo Alto Networks Cloud NGFW | Not stated | All is not affected |
| Palo Alto Networks PAN-OS | from 10.1.0 before 10.1.14-h9 from 10.2.0 before 10.2.7-h24 from 11.1.0 before 11.1.6-h1 from 11.2.0 before 11.2.4-h4 | Not stated |
| Palo Alto Networks Prisma Access | Not stated | All is not affected |
- Fixed in: 10.1.14-h9, 10.2.7-h24, 11.1.6-h1, 11.2.4-h4 (versions before these are affected).
- Exploited: yes, on CISA’s Known Exploited Vulnerabilities list since 18 Feb 2025; CISA’s deadline for US agencies was 11 Mar 2025.
- Detection: free a Nuclei template and a Suricata rule from vedas-signatures, explained on the CVE-2025-0108 page.
What to do now
- the management web UI of a firewall must never be reachable from the internet; enforce it with a separate management VRF and verify with an external scan.
- For CVE-2024-0012, upgrade to 11.2.4-h1, 11.1.5-h1, 11.0.6-h1, 10.2.12-h2 or later.
- For CVE-2025-0108, upgrade to 10.1.14-h9, 10.2.7-h24, 11.1.6-h1, 11.2.4-h4 or later.
Live scores
Live scores
CVE-2024-0012- EPSS
- 0.998
very likely to be attacked soon - VEDAS
- 0.980
strong exploit evidence - On CISA KEV
- Yes, since 2024-11-18
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-0108- EPSS
- 0.985
very likely to be attacked soon - VEDAS
- 0.989
strong exploit evidence - On CISA KEV
- Yes, since 2025-02-18
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.