PAN-OS: Authentication Bypass in SAML Authentication (CVE-2020-2021)

What is affected, what to do

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Palo Alto Networks PAN-OS to version 8.1.15, Palo Alto Networks PAN-OS to version 9.0.9, Palo Alto Networks PAN-OS to version 9.1.3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Palo Alto Networks PAN-OS eq 8.0.*..8.0.*
• Palo Alto Networks PAN-OS lt 8.1..8.1.15
• Palo Alto Networks PAN-OS lt 9.0..9.0.9
• Palo Alto Networks PAN-OS lt 9.1..9.1.3

Fixed in

• Palo Alto Networks PAN-OS 8.1.15
• Palo Alto Networks PAN-OS 9.0.9
• Palo Alto Networks PAN-OS 9.1.3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Confirm exposure: On every PAN-OS firewall, Panorama instance and Prisma Access tenant, check whether SAML is in use (Device > Server Profiles > SAML Identity Provider) and whether "Validate Identity Provider Certificate" is unchecked in the IdP server profile. Only that combination is exploitable. Start with internet-facing GlobalProtect portals/gateways, Clientless VPN and Captive Portal.
   • Patch: Upgrade to PAN-OS 9.1.3, 9.0.9 or 8.1.15 or later. PAN-OS 8.0 is EOL and will not receive a fix. Migrate those devices to a supported train, or immediately disconnect them or remove SAML from them.
   • Stop-gap if you can't patch yet: Enable "Validate Identity Provider Certificate". First confirm that your IdP signing certificate meets PAN-OS requirements (see the vendor advisory), or logins will break. If that isn't feasible quickly, temporarily switch to another authentication method (e.g. RADIUS/LDAP with MFA).
   • Lock down management access: PAN-OS and Panorama web interfaces must not be reachable from the internet. Restrict them through interface management profiles and permitted-IP lists to a dedicated management network or jump-host zone.
   • Compromise assessment: If a vulnerable configuration was exposed, review config logs and admin logins retroactively. Then rotate admin credentials, API keys, local accounts and secrets stored on the device (IPsec PSKs, LDAP bind accounts, certificate private keys). Diff the running config against a known-good baseline.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Make management interfaces (MGT port, management profiles on dataplane interfaces) reachable only from an isolated management VLAN. Explicitly deny access from user, DMZ and internet zones in security policy.
   • Configuration hardening: Enforce IdP certificate validation in every SAML IdP server profile. Codify it as a compliance check in Panorama templates or your config-management pipeline (e.g. periodic API export and diff), and alert on drift.
   • IAM / least privilege: Use role-based admin profiles instead of blanket superuser. Scope GlobalProtect and Captive Portal security policies so authenticated users only reach required resources. This caps blast radius if authentication is bypassed.
   • Upstream access control: Where possible, front GlobalProtect portals/gateways with geo-IP or source-IP restrictions or a reverse proxy/WAF. Log and rate-limit SAML ACS requests (e.g. POSTs to /SAML20/SP/ACS) from unexpected sources.
   • Lifecycle: Treat any PAN-OS 8.0 device as unmaintainable, record it in the risk register (ISO 27001 A.8.8 / NIS2 Art. 21), and schedule replacement.
3. 03

   Runbook step 3

   Detection rules

   • IdP correlation (strongest signal): Successful SAML logins to the firewall, Panorama or GlobalProtect with no matching authentication event in the IdP logs (Entra ID sign-ins, Okta System Log, ADFS EID 1200) in the same time window. KQL sketch: PaloAlto_System | where EventID has "auth-success" or EventID has "globalprotect" | join kind=leftanti (SigninLogs | where AppDisplayName has "Palo Alto") on $left.User == $right.UserPrincipalName
   • PAN-OS system log: SAML admin logins (auth-success, web UI login events) from source IPs outside the management network, at odd hours, or with unknown usernames. SPL: index=pan sourcetype=pan:system (eventid=auth-success OR eventid=*globalprotect*auth*) | stats count by src_ip, user | where NOT cidrmatch("10.10.0.0/24", src_ip) (adjust the management CIDR).
   • Config log: Unexpected commits, new admin accounts, modified security/NAT rules or management profiles, and config or certificate exports shortly after a SAML admin login. Sigma shape: logsource: pan config with cmd: (add|set|commit) and admin not in an allow-list.
   • Network telemetry (Zeek/Suricata): HTTP POSTs carrying a SAMLResponse parameter to GlobalProtect or management endpoints without a preceding redirect to the IdP (missing SP-initiated flow), or from low-reputation source IPs. If TLS terminates on an upstream WAF, inspect there.
   • GlobalProtect sessions: VPN sessions for usernames that don't exist in the directory, or concurrent sessions for the same user from different countries. Correlate with follow-on lateral movement (SMB/RDP from the VPN pool).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.

Source: cvelistv5, NVD (NIST), CISA KEV Catalog

Vendors and products

• Palo Alto Networks Pan-os
• Palo Alto Networks Palo Alto Networks PAN-OS

Weakness classes (CWE)

• CWE-347Improper Verification of Cryptographic Signature

  Base

  The product does not verify, or incorrectly verifies, the cryptographic signature for data.

  Entry at MITRE CWE-347

References & sources

• security.paloaltonetworks.comCVE-2020-2021x_refsource_MISC, Mitigation, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2021government-resource, US government resource
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2020-ALE-014 – Vulnérabilité dans Palo Alto Networks PAN-OS (clôturée 2020-07-31)cert-fr