An authentication bypass exists in the management web interface of PAN-OS, allowing an unauthenticated attacker with network access to bypass authentication and invoke specific PHP scripts. This issue stems from path confusion between Nginx and Apache. While it does not allow remote code execution, it can compromise the integrity and confidentiality of the system, enabling attackers to extract sensitive system data, recover firewall configurations, or manipulate certain settings. Approximately 4,400 devices have been identified as exposing their management interface to the internet. Real-world exploitation has been observed, including activity by Qilin ransomware for initial access and attempts detected by GreyNoise starting February 13.