CVE-2020-1998: PAN-OS: Improper SAML SSO authorization of shared local users

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-13 · updated 2026-06-17
Weakness: CWE-285

Description

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0.

Affected products

Palo Alto Networks PAN-OS: from 7.1.0 before 7.1.26; from 8.0.0 through 8.0.20; from 8.1.0 before 8.1.13; from 9.0.0 before 9.0.6; from 9.1.0 before 9.1.1 — fixed in 7.1.26, 8.1.13, 9.0.6, 9.1.1
Palo Alto Networks PAN-OS: from 8.1 before 8.1.13; from 7.1 before 7.1.26; from 9.0 before 9.0.6; from 9.1 before 9.1.1; 8.0.* — fixed in 8.1.13, 7.1.26, 9.0.6, 9.1.1

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 7.1.26, 8.1.13, 9.0.6, 9.1.1; Palo Alto Networks PAN-OS 8.1.13, 7.1.26, 9.0.6, 9.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-1998 or the next vulnerability affects your stack