CVE-2020-2021: Palo Alto PAN-OS SAML authentication bypass, in CISA KEV
The short version: CVE-2020-2021 is an authentication-bypass flaw in the SAML authentication of PAN-OS. When SAML is enabled and the 'Validate Identity Provider Certificate' option is disabled, the device improperly verifies signatures — so an unauthenticated attacker can slip past authentication on resources like GlobalProtect and the management interface. It's a perfect 10.0 on paper and is in CISA's KEV catalog, but it only bites in a specific configuration. Steady hands — check your config, then patch.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — real, but gated by a specific misconfiguration (see below) |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVSS (Palo Alto) | 10.0 — Critical |
| EPSS | ~4.36% · 90.17th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2022-04-15 |
| Known exploited? | Listed in CISA KEV; at disclosure Palo Alto stated it was not aware of malicious exploitation |
| Vulnerability type | CWE-347 improper verification of cryptographic signature → SAML authentication bypass |
| Requires authenticated session? | No — pre-authentication (when the affected SAML configuration is present) |
| Affected | PAN-OS 8.0 (EOL), 8.1 < 8.1.15, 9.0 < 9.0.9, 9.1 < 9.1.3 — with SAML enabled and certificate validation disabled |
| Fixed in | PAN-OS 8.1.15 · 9.0.9 · 9.1.3 (and later); PAN-OS 7.1 and earlier are not affected |
What you need to know
PAN-OS can use SAML for single sign-on to services like GlobalProtect and the web management interface. CVE-2020-2021 is an improper-signature-verification bug: when SAML is in use and the 'Validate Identity Provider Certificate' setting is disabled, the device fails to properly validate the SAML response — allowing an attacker to forge an assertion and be treated as an authenticated user, no password required.
The two conditions that make this real:
- SAML is enabled on an affected service, and
- certificate validation is turned off in the SAML identity-provider profile.
Where both hold, this is a clean pre-authentication bypass on an internet-facing access device. Where they don't, the device isn't exposed to it.
How serious we see it
Critical — with an honest asterisk.
The base score is a maximum 10.0, and mechanically that's fair: unauthenticated bypass on a perimeter access device, with scope change. But the practical severity is gated by configuration — it requires SAML with certificate validation disabled — and real-world exploitation stayed low (a modest EPSS reflects that; at disclosure Palo Alto was not aware of malicious attempts). So we treat it as High rather than reflexively Critical: genuinely dangerous where the configuration matches, and quick to rule out where it doesn't. The reassuring part is that both the fix and the mitigating setting are in your hands.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to PAN-OS 8.1.15 / 9.0.9 / 9.1.3 or later. PAN-OS 8.0 is End-of-Life — migrate off it.
- Enable certificate validation. As a mitigation, turn on 'Validate Identity Provider Certificate' in the SAML profile and use a properly signed IdP certificate.
- Confirm the affected config first. Check whether SAML is enabled and whether certificate validation is disabled — that tells you instantly whether you're exposed.
- Hunt. Review authentication logs for unexpected SAML logins to GlobalProtect or the management interface.
- Reduce exposure. Keep the management interface off the public internet.
How BreachRisk sees it
BreachRisk discovers internet-facing PAN-OS GlobalProtect and management interfaces from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed vulnerabilities like this one so it rises to the top of your results rather than getting lost in a scanner backlog.
We're straight about the limits: from the outside we flag the exposed, affected device — the final confirmation for this one depends on the SAML certificate-validation setting, which is exactly the config check to run first. The continuous, outside-in view means the exposed appliance is already on your radar when you go to verify it.