CVE-2020-2021
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-...
Affects 1 product across 1 vendor.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2020-2021 affects Palo Alto Networks PAN-OS when SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is unchecked. This allows an unauthenticated attacker to access protected resources, potentially leading to full administrative control over the web interfaces. The vulnerability has a CVSS score of 10.0, indicating critical severity. Affected versions include PAN-OS 9.1 (pre-9.1.3), 9.0 (pre-9.0.9), 8.1 (pre-8.1.15), and all 8.0 versions. The impact is mitigated if SAML is not used or if the certificate validation is enabled.
BSID: BS-2020-GLOBAL-277929-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2020-2021?
What is the CVSS score for CVE-2020-2021?
Is CVE-2020-2021 actively exploited?
How do I remediate CVE-2020-2021?
What systems are affected by CVE-2020-2021?
What NERC-CIP standard applies to CVE-2020-2021?
What IEC 62443 requirement maps to CVE-2020-2021?
| CVE ID | CVE-2020-2021 |
|---|---|
| BSID | BS-2020-GLOBAL-277929-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2020-06-29 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 65% |
| Weakness (CWE) | |
| Domains | |
| Source | NVD |
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be exploited by an unauthenticated attacker with network access to the affected server. The attacker can bypass SAML authentication and gain access to protected resources, including administrative interfaces. This can lead to unauthorized access and potential administrative actions on the affected systems. The attacker does not need to inspect or tamper with existing user sessions, but can gain full control over the web interfaces if the 'Validate Identity Provider Certificate' option is disabled.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Palo Alto Networks | Pan-Os | ≥ 8.0.0, ≤ 8.0.20 ≥ 8.1, < 8.1.15 ≥ 9.0, < 9.0.9 ≥ 9.1, < 9.1.3 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2022-03-25) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Ensure that the 'Validate Identity Provider Certificate' option is enabled in the SAML Identity Provider Server Profile. Restrict network access to the PAN-OS and Panorama web interfaces to a trusted management network. Regularly review and audit authentication logs for any suspicious activity.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to the web interfaces, which could compromise the security of the electronic security perimeter.
This CVE maps to SR 7.6 because it involves a failure in the authentication mechanism, allowing an attacker to bypass security controls and gain unauthorized access to the system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | b7e1044d1afdfe8f69c6c7f66760a5bfefe5e8f5e6eaa36ae107d97b5edf5cac4f866b722492a11027f6bcd3a2f3c2cdbc1a34e1c92d67f2c1fe5f4c359f6c37 |
This Vulnerability Is Being Actively Exploited
CVE-2020-2021 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →