Palo Alto Networks firewalls are under active exploitation as cybercriminals chain multiple vulnerabilities (CVE-2025-0108, CVE-2024-9474, and CVE-2025-0111) to gain root access to unpatched systems. CVE-2024-9474, a privilege escalation flaw patched in November 2024, allows administrators to execute commands with root privileges. In February 2025, Palo Alto Networks patched CVE-2025-0108, an authentication bypass vulnerability that lets unauthenticated attackers access certain PHP scripts via the PAN-OS management web interface. Shortly after, researchers demonstrated how CVE-2025-0108 could be chained with CVE-2024-9474, and active exploitation quickly followed. Additionally, CVE-2025-0111, a file read vulnerability patched the same day, is now being used in exploit chains to extract sensitive configuration data. Researchers have observed a sharp increase in attack activity, with twenty-five (25) malicious IP addresses targeting these flaws, primarily from the U.S., Germany, and the Netherlands. Many PAN-OS devices remain vulnerable, with reports indicating that 65% of exposed systems have not applied patches. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-0108 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate by no later than March 11, 2025. Palo Alto strongly urges administrators to apply the latest security updates immediately and to secure external-facing management interfaces, since merely restricting access does not eliminate the risk. Meanwhile, a general hotfix is to be released by February 20, 2025, with some customers already receiving a limited-release patch. Given the growing exploitation, CTIX analysts stress that exposing management consoles to the internet is a significant risk and should be avoided whenever possible.