CVE-2025-4615

FAUCET Score

CVE-2025-4615 is an improper input neutralization vulnerability affecting the management web interface of Palo Alto Networks PAN-OS software, allowing an authenticated administrator to bypass system restrictions and execute arbitrary commands. Rated High (CVSS 7.2), this vulnerability has low attack complexity but requires high privileges, enabling full compromise of confidentiality, integrity, and availability. The security risk is significantly minimized when CLI access is restricted to a limited group of administrators. There is currently no evidence of active exploitation, no public exploit code available, and minimal community discussion surrounding this vulnerability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 10.2.0, < 10.2.17CPE matchmatch criteria	cpe:2.3:o:paloaltonetworks:pan-os::::::::
		>= 11.1.0, < 11.1.11CPE matchmatch criteria	cpe:2.3:o:paloaltonetworks:pan-os::::::::
		>= 11.2.0, < 11.2.8CPE matchmatch criteria	cpe:2.3:o:paloaltonetworks:pan-os::::::::

CVSS Data

CVSS version used by this source: 4.0

5.5MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

HIGH

User Interaction

NONE

VS Confidentiality

NONE

VS Integrity

HIGH

VS Availability

HIGH

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

0.74%

Probability of exploitation in next 30 days

EPSS Percentile

50.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.0074 is in the 31st percentile among its peer group of 5,530 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (18)

astropatch availablevia llm_extracted

Fixed in: 11.2.8, 11.1.4-h27, 11.1.6-h21, 11.1.10-h7, 10.2.17

View patch

asustorpatch availablevia llm_extracted

Fixed in: 10.2.17, 11.1.10-h7, 11.1.4-h27, 11.1.6-h21, 11.2.8

View patch

bigbluebuttonpatch availablevia llm_extracted

Fixed in: 11.2.8

coollabspatch availablevia llm_extracted

Fixed in: 11.2.8, 11.1.4-h27, 11.1.6-h21, 11.1.10-h7, 10.2.17

View patch

langgeniuspatch availablevia llm_extracted

Fixed in: 10.2.17, 11.1.10-h7, 11.1.4-h27, 11.1.6-h21, 11.2.8

View patch

lfedgepatch availablevia llm_extracted

Fixed in: 10.2.17, 11.1.10-h7, 11.1.4-h27, 11.1.6-h21, 11.2.8

View patch

linksyspatch availablevia llm_extracted

Fixed in: 11.2.8, 11.1.4-h27, 11.1.6-h21, 11.1.10-h7, 10.2.17

View patch

mattermostpatch availablevia llm_extracted

Fixed in: 11.2.8

View patch

meshtasticpatch availablevia llm_extracted

Fixed in: 11.2.8, 11.1.4-h27, 11.1.6-h21, 11.1.10-h7, 10.2.17

meterspherepatch availablevia llm_extracted

Fixed in: 11.2.8, 11.1.4-h27, 11.1.6-h21, 11.1.10-h7, 10.2.17

View patch

notaryprojectpatch availablevia llm_extracted

Fixed in: All, All, >= 11.2.8, >= 11.1.4-h27, >= 11.1.6-h21, >= 11.1.10-h7, >= 10.2.17, All

View patch

nvidiapatch availablevia llm_extracted

Fixed in: 11.2.8, 11.1.4-h27, 11.1.6-h21, 11.1.10-h7, 10.2.17

View patch

opensslpatch availablevia llm_extracted

Fixed in: 10.2.17, 11.1.10-h7, 11.1.4-h27, 11.1.6-h21, 11.2.8

View patch

sitecorepatch availablevia llm_extracted

Fixed in: 11.2.8

View patch

strapipatch availablevia llm_extracted

Fixed in: 10.2.17, 11.1.10-h7, 11.1.4-h27, 11.1.6-h21, 11.2.8

View patch

vantage6patch availablevia llm_extracted

Fixed in: 11.2.8

View patch

wazuhpatch availablevia llm_extracted

Fixed in: ['11.2.8', '11.1.4-h27', '11.1.6-h21', '11.1.10-h7', '10.2.17']

View patch

paloaltovendor investigatingvia nvd_reference

View patch

Vendor Advisories (18)

paloaltopaloalto:security.paloaltonetworks.com/CVE-2025-4615MEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface (Severity: MEDIUM)

Dec 19, 2025

wazuhllm-wazuh-74e44fb18c54df60MEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

coollabsllm-coollabs-f4bd4f61b922d52cMEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

bigbluebuttonllm-bigbluebutton-f215095e16abe73fMEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

sitecorellm-sitecore-514d88d4ab350b53MEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

notaryprojectllm-notaryproject-679f13ac3d49311dMEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

linksysllm-linksys-ac7e3af2fd7ec427MEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

astrollm-astro-080da12f25cd3c8bMEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

vantage6llm-vantage6-e1b719acca72f3d3MEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

strapillm-strapi-d693a51daeeddb40MEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

opensslllm-openssl-0496171974ee856aMEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

nvidiallm-nvidia-e21333f7a8d0ac20MEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

asustorllm-asustor-81ec2c9376487e97MEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

meterspherellm-metersphere-c5b7dfcea47de8d7MEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

lfedgellm-lfedge-c05cb26e22829c6bMEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

meshtasticllm-meshtastic-70af4a1713b22756MEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

langgeniusllm-langgenius-dd3bc5f3a8f70604MEDIUM

CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

mattermostllm-mattermost-b862b0aeb18bed68MEDIUM

PAN-OS: Improper Neutralization of Input in the Management Web Interface

Oct 8, 2025

References

security.paloaltonetworks.com / CVEN-2025-4615

Vendor Advisory