Vulnerability record · CVE-2020-2021 · published 29 June 2020
CVE-2020-2021: PAN-OS SAML signature verification bypass allows authentication bypass
Paloaltonetworks · Pan Os
PAN-OS fails to properly verify SAML signatures when SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is unchecked. An unauthenticated network attacker can then forge SAML assertions and reach resources protected by SAML SSO, including GlobalProtect portals/gateways, Clientless VPN, Captive Portal, Prisma Access, and PAN-OS/Panorama web interfaces.
Description
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0 authentication bypass with no preconditions beyond a common misconfiguration, listed in CISA KEV with known ransomware use.
What it is
PAN-OS fails to properly verify SAML signatures when SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is unchecked. An unauthenticated network attacker can then forge SAML assertions and reach resources protected by SAML SSO, including GlobalProtect portals/gateways, Clientless VPN, Captive Portal, Prisma Access, and PAN-OS/Panorama web interfaces.
Impact
An attacker gains access to protected resources without valid credentials; against PAN-OS or Panorama web interfaces this means logging in as an administrator and performing administrative actions. Integrity and availability of the gateway, portal, or VPN server itself are not affected, and regular user sessions cannot be inspected or tampered with.
Attack surface
Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N); the only precondition is that SAML is used for authentication and the 'Validate Identity Provider Certificate' option is disabled. If the web interfaces sit on a restricted management network, the vector becomes adjacent (AV:A) and the score drops to 9.6.
Exploitation
Listed in CISA KEV (added 2022-03-25, due 2022-04-15) with known ransomware campaign use, so exploitation has occurred in the wild. EPSS 30-day probability is 0.04362 (90.8th percentile), and the vendor stated at publication it was not aware of malicious attempts.
What to do
- Upgrade to PAN-OS 9.1.3, 9.0.9, or 8.1.15 or later; PAN-OS 8.0 is EOL and must be replaced.
- Enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile.
- If SAML is not required, disable SAML authentication.
- Restrict network access to PAN-OS and Panorama management web interfaces to a trusted management network.
- Review SAML IdP configurations and certificates for unauthorized changes.
Detection
- Audit PAN-OS and Panorama configurations for SAML authentication enabled with 'Validate Identity Provider Certificate' unchecked.
- Monitor authentication logs for successful SAML logins from unexpected source IPs or without a corresponding IdP-side authentication event.
- Alert on administrative logins to PAN-OS or Panorama web interfaces from outside the management network.
- Hunt for GlobalProtect, Clientless VPN, or Captive Portal sessions that begin without prior credential or IdP authentication.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-2021 to the Known Exploited Vulnerabilities catalog on 25 March 2022 as "Palo Alto Networks PAN-OS Authentication Bypass Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 15 April 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2020-2021 | MitigationVendor Advisory |
| https://security.paloaltonetworks.com/CVE-2020-2021 | MitigationVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2021 | US Government Resource |
Track CVE-2020-2021 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-2021), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
