CVE-2020-2039: PAN-OS management web interface uncontrolled resource consumption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityUnauthenticated remote availability impact on the management plane with high EPSS, but no KEV listing, no known exploit, and only low availability impact per CVSS.

What it is

The PAN-OS management web interface fails to delete temporary files uploaded during requests, allowing uncontrolled disk consumption. A remote unauthenticated attacker can repeatedly upload files until available disk space is exhausted, disrupting the management web interface. The flaw affects PAN-OS 8.1, 9.0, 9.1 and 10.0 branches below their fixed releases.

Impact

An attacker can degrade or take down the management web interface by exhausting disk space, blocking administrators from managing the device. There is no confidentiality or integrity impact; only availability of the management plane is affected.

Attack surface

Reachable over the network through the PAN-OS management web interface, per the CVSS vector AV:N/PR:N/UI:N no authentication or user interaction is required. Exposure is limited to deployments where the management interface is network-reachable.

Exploitation

Not listed in CISA KEV and no public exploit tags appear in the references, which are vendor advisories only. EPSS is high (0.46383, 98.8th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade to PAN-OS 8.1.16, 9.0.10, 9.1.4 or 10.0.1 or later as applicable to your branch.
• Restrict management web interface access to trusted administrative networks and disable it on untrusted interfaces.
• Monitor management-plane disk usage and alert on abnormal growth or repeated upload activity.
• Apply rate limiting or access controls in front of the management interface where feasible.

Detection

• Track management-plane disk utilization trends and alert on sustained or sudden increases.
• Review management web interface access logs for repeated upload requests from single or unfamiliar sources.
• Monitor for management interface unavailability or failed administrative logins coinciding with disk pressure.
• Inspect temporary file directories on the firewall for accumulation of undeleted upload artifacts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.