Actively exploited in the wild
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks - PAN-OS · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-2021
CriticalCVSS 10.0KEVSummary
A vulnerability in PAN-OS SAML authentication due to improper signature verification when the 'Validate Identity Provider Certificate' option is disabled. An unauthenticated network-based attacker can access protected resources, and for PAN-OS/Panorama web interfaces, can log in as an administrator. Affects PAN-OS 9.1 < 9.1.3, 9.0 < 9.0.9, 8.1 < 8.1.15, and all 8.0 versions (EOL).
Risk Assessment
In the worst case (web interfaces), an attacker can gain administrative control over the device, posing a critical risk to the organization. If web interfaces are restricted to a management network, the risk is slightly lower but still high.
Recommendation
Immediately upgrade PAN-OS to version 9.1.3, 9.0.9, or 8.1.15 (or later). If upgrade is not possible, enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile or restrict network access to management interfaces.
Other vulnerabilities in PAN-OS
See all- CVE-2026-0322HighActively exploited
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. This affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted.
- CVE-2026-0258Critical
An SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a DoS condition.
- CVE-2026-0264Critical
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.
- CVE-2026-0263Critical
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
- CVE-2025-0111MediumActively exploited
An authenticated attacker with network access to the PAN-OS management web interface can read files on the filesystem that are readable by the 'nobody' user. This issue does not affect Cloud NGFW or Prisma Access.
- CVE-2025-0108CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts. This does not enable remote code execution but can negatively impact integrity and confidentiality.
- CVE-2024-9474HighActively exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-0012CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. Affects PAN-OS 10.2, 11.0, 11.1, and 11.2. Risk can be reduced by restricting access to the management interface to trusted IPs.
- CVE-2019-1579HighActively exploited
Remote code execution vulnerability in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. An unauthenticated remote attacker can execute arbitrary code.
- CVE-2026-0320Medium
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. Exploitation requires access to the PAN-OS management interface.
Original NVD description (English source)
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS