CISA Warns: Palo Alto Networks & SonicWall Flaws Under Active Exploitation 2025

CISA Adds Palo Alto Networks and SonicWall Flaws to Exploited Vulnerabilities List

Cybersecurity remains a constant battleground as organizations strive to protect their networks from ever-evolving threats. The latest development in this ongoing fight comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has recently added two significant security vulnerabilities affecting Palo Alto Networks PAN-OS and SonicWall SonicOS SSLVPN to its Known Exploited Vulnerabilities (KEV) catalog. These flaws have been actively exploited, posing severe risks to enterprises and government agencies.

In this article, we will break down the details of these vulnerabilities, discuss their impact, and outline steps organizations should take to mitigate the risks.

Key Security Vulnerabilities Identified

CVE-2025-0108: Authentication Bypass in PAN-OS

• CVSS Score: 7.8 (High Severity)
• Affected System: Palo Alto Networks PAN-OS management web interface
• Issue: This vulnerability allows an unauthenticated attacker with network access to bypass authentication and invoke specific PHP scripts, effectively granting unauthorized access to critical systems.
• Exploitation Status: Palo Alto Networks has observed real-world exploit attempts chaining CVE-2025-0108 with CVE-2024-9474 and CVE-2025-0111, amplifying the attack surface for threat actors.

CVE-2024-53704: Improper Authentication in SSLVPN

• CVSS Score: 8.2 (High Severity)
• Affected System: SonicWall SonicOS SSLVPN authentication mechanism
• Issue: This vulnerability allows a remote attacker to bypass authentication measures, potentially leading to unauthorized access.
• Exploitation Status: Threat intelligence firm Arctic Wolf has confirmed that cybercriminals are already weaponizing this flaw, following the release of a Proof-of-Concept (PoC) exploit by security researchers at Bishop Fox.

How Widespread is the Threat?

According to GreyNoise, a threat intelligence company, as many as 25 malicious IP addresses are actively exploiting CVE-2025-0108. The attack volume has surged 10 times since initial detection, with the top three attack sources originating from the United States, Germany, and the Netherlands.

Given the widespread exploitation and the potential for these vulnerabilities to be chained with other security flaws, the risks are not just theoretical but actively being leveraged by cybercriminals.

CISA’s Directives and Remediation Measures

In response to these threats, CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies remediate the identified vulnerabilities by March 11, 2025. Organizations beyond the federal sector should also take immediate action to safeguard their networks.

Recommended Mitigation Steps

1. Apply Security Patches Immediately: Ensure that your systems are updated with the latest patches from Palo Alto Networks and SonicWall.
2. Restrict Management Interface Access: Limit external exposure of firewall management interfaces to only authorized personnel.
3. Enable Multi-Factor Authentication (MFA): Strengthen access controls by requiring MFA for all remote access.
4. Monitor for Indicators of Compromise (IoCs): Regularly review security logs and threat intelligence reports for any unusual activity.
5. Deploy Network Segmentation: Limit lateral movement within your network by implementing strict segmentation policies.
6. Update Incident Response Plans: Ensure your organization has a response strategy in place to mitigate potential breaches quickly.

Broader Implications for Cybersecurity

Rising Trends in Cyber Exploits

The rapid weaponization of newly disclosed vulnerabilities highlights a growing trend in cybersecurity where threat actors quickly adapt and exploit flaws within days or even hours of disclosure. This trend is concerning because:

• Organizations often struggle with timely patching, leaving critical systems exposed.
• Attackers leverage automation and AI to identify and exploit weaknesses faster than ever before.
• State-sponsored actors and cybercriminals are increasing their focus on critical infrastructure, government agencies, and enterprises.

Role of Threat Intelligence in Defense

Organizations must prioritize proactive threat intelligence to stay ahead of cyber adversaries. By leveraging real-time data from sources like GreyNoise, Arctic Wolf, and CISA, businesses can:

• Identify active exploits early and take defensive action.
• Adjust security policies dynamically based on emerging threats.
• Educate employees and IT teams about evolving risks.

Conclusion: The Urgency of Cyber Resilience

The addition of CVE-2025-0108 and CVE-2024-53704 to CISA’s Known Exploited Vulnerabilities list underscores the critical need for organizations to act swiftly. Whether you operate in government, finance, healthcare, or any other industry, cyber resilience must be a top priority.

To protect your systems:

• Apply patches immediately
• Strengthen authentication controls
• Monitor your network for suspicious activity

Cyber threats are evolving—your defense strategy should too.