Palo Alto Networks PAN-OS SAML Signature Verification Bypass Vulnerability (CVE-2020-2021)
Executive & SecOps Summary
SECOPS ASSESSMENTPAN-OS 8.1, 9.0, and 9.1 versions, Panorama, and GlobalProtect gateways with SAML authentication enabled and 'Validate Identity Provider Certificate' disabled
Unauthenticated remote attackers can bypass SAML signature verification to gain administrative access to PAN-OS/Panorama web interfaces or access protected network resources
Upgrade PAN-OS to patched versions (9.1.3, 9.0.9, 8.1.15 or later) or enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your PAN-OS devices to the designated patched releases immediately.
- PAN-OS 8.1: Upgrade to 8.1.15 or later
- PAN-OS 9.0: Upgrade to 9.0.9 or later
- PAN-OS 9.1: Upgrade to 9.1.3 or later
Example CLI commands to perform PAN-OS upgrade:
# Retrieve the latest software information
request system software info
# Download the target patched version (e.g., 9.1.3)
request system software download version 9.1.3
# Install the downloaded version and reboot
request system software install version 9.1.3
request restart system2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, you must enforce IDP certificate validation in your SAML profiles.
Configure the workaround via PAN-OS CLI:
# Enter configuration mode
configure
# Enable IDP certificate validation (replace <SAML_PROFILE_NAME> with your actual profile name)
set shared saml-auth-profile <SAML_PROFILE_NAME> validate-idp-certificate yes
# Commit the changes
commit3. Log Audit & IoC Verification Commands
Verify your SAML profile configuration and audit system logs for suspicious authentication attempts using the following commands:
# Verify if 'validate-idp-certificate' is set to 'yes' for all profiles
show shared saml-auth-profile all
# Audit system logs for SAML authentication events and inspect source IPs
show log system direction equal backward category equal auth | match SAMLStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-2021) is a cryptographic signature verification bypass (CWE-347) in the SAML authentication module of Palo Alto Networks PAN-OS. When SAML Single Sign-On (SSO) is configured and the 'Validate Identity Provider Certificate' option is unchecked (disabled) in the SAML Identity Provider Server Profile, PAN-OS fails to properly validate the cryptographic signatures of incoming SAML assertions. This allows an attacker to forge SAML responses and authenticate successfully without possessing valid credentials.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker with network access to the vulnerable PAN-OS interface or GlobalProtect portal can initiate a SAML authentication flow. By intercepting or constructing a malicious SAML assertion, the attacker can inject arbitrary usernames (such as administrative accounts) and bypass the signature verification step entirely because the system is configured not to validate the IDP certificate. The target system accepts the forged assertion as trusted, granting the attacker immediate access.
3. Infrastructure & Business Impact
This vulnerability carries a maximum CVSS Base Score of 10.0, representing a critical threat. If exploited against GlobalProtect portals or Clientless VPNs, attackers can gain unauthorized access to internal corporate networks. If exploited against PAN-OS or Panorama web management interfaces, attackers can log in with full administrative privileges, allowing them to alter security policies, compromise network traffic, and establish persistent backdoors across the entire enterprise infrastructure.
Official Vendor Advisories & References
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.
Frequently Asked SecOps Questions (CVE-2020-2021)
FAQQ1. How critical is CVE-2020-2021 and is it actively exploited in the wild?
CVE-2020-2021 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 4.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-2021?
Primary impacted vendors include paloaltonetworks across pan-os, panorama, globalprotect. Scope summary: PAN-OS 9.1 versions earlier than 9.1.3; PAN-OS 9.0 versions earlier than 9.0.9; PAN-OS 8.1 versions earlier than 8.1.15; and all PAN-OS 8.0 versions (EOL). Only affected if SAML is used and 'Validate Identity Provider Certificate' is disabled.
Q3. What temporary mitigations or workarounds exist for CVE-2020-2021 before patching?
[Mitigation] Upgrade PAN-OS to patched versions (9.1.3, 9.0.9, 8.1.15 or later) or enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-2021
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paloaltonetworks)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).
Palo Alto Networks PAN-OS Management Interface Remote Code Execution (RCE) Vulnerability (CVE-2026-0322)
[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS
SimpleHelp Authentication Bypass via Missing OIDC Signature Verification (CVE-2026-48558)
[Affected Scope] SimpleHelp versions 5.5.15 and prior, and 6.0 pre-release versions with OIDC authentication configured
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.