What is the CVSS score of CVE-2025-4230?

CVE-2025-4230 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/V:D/U:Amber. EPSS exploitation probability: 0.1%.

Which versions of Paloalto are affected by CVE-2025-4230?

Palo Alto Networks PAN-OS contains a command injection vulnerability (CVE-2025-4230, CVSS 8.8) that allows authenticated administrators with CLI access to execute arbitrary root commands, potentially…. A patch is available.

How to fix or mitigate CVE-2025-4230?

Within 24 hours: Identify all on-premises PAN-OS deployments and audit CLI access permissions; restrict administrator CLI access to minimal required staff pending patch deployment. Within 7 days: Obtain and deploy available vendor patch to all affected on-premises PAN-OS instances; verify successful deployment. Within 30 days: Conduct post-patch verification and implement CLI access logging to detect unauthorized privilege escalation attempts.

Paloalto CVE-2025-4230

EUVD-2025-18226 HIGH

OS Command Injection (CWE-78)

2025-06-13 psirt@paloaltonetworks.com

Paloalto Command Injection RCE Privilege Escalation

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/V:D/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/V:D/U:Amber

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:39 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.2.6,11.1.10,10.1.14-h15

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18226

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 00:15 nvd

HIGH 8.4

DescriptionCVE.org

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

Cloud NGFW and Prisma® Access are not affected by this vulnerability.

AnalysisAI

Command injection vulnerability in Palo Alto Networks PAN-OS that allows authenticated administrators with CLI access to bypass system restrictions and execute arbitrary commands with root privileges. The vulnerability affects on-premises PAN-OS deployments with CVSS 8.4, but risk is significantly reduced in environments where CLI access is restricted to a limited administrative group. Cloud NGFW and Prisma Access are not affected.

Technical ContextAI

This vulnerability is a CWE-78 (Improper Neutralization of Special Elements used in an OS Command) command injection flaw in the Palo Alto Networks PAN-OS command-line interface. The vulnerability stems from insufficient input validation in CLI command processing, allowing authenticated users to inject arbitrary OS commands that execute with root privileges. PAN-OS is a security operating system running on Palo Alto Networks firewalls (PA-Series, VM-Series) and management appliances. The flaw exists in the CLI parsing mechanism where user-supplied input is not properly sanitized before being passed to underlying OS command execution functions, enabling an attacker to break out of the intended command context and execute arbitrary shell commands.

RemediationAI

Primary remediation: Apply Palo Alto Networks security patches for affected PAN-OS versions as released in the official security advisory. Interim mitigations if patches are unavailable: (1) Restrict PAN-OS CLI access to a minimal set of trusted administrators through role-based access control (RBAC) and administrative account management; (2) Implement network segmentation to limit management plane access to trusted administrative networks only; (3) Audit and revoke unnecessary administrative CLI privileges; (4) Enable comprehensive CLI command logging and monitoring for anomalous command execution patterns; (5) Use out-of-band management networks to isolate administrative access. Verify patch deployment thoroughly in test environments before production rollout.