CVE-2020-2039: PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 46.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-09 · updated 2026-06-17
Weakness: CWE-400

Description

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

Affected products

Palo Alto Networks PAN-OS: from 8.1.0 before 8.1.16; from 9.0.0 before 9.0.10; from 9.1.0 before 9.1.4; from 10.0.0 before 10.0.1 — fixed in 8.1.16, 9.0.10, 9.1.4, 10.0.1
Palo Alto Networks PAN-OS: from 9.1 before 9.1.4; from 8.1 before 8.1.16; from 9.0 before 9.0.10; from 10.0 before 10.0.1 — fixed in 9.1.4, 8.1.16, 9.0.10, 10.0.1

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 8.1.16, 9.0.10, 9.1.4, 10.0.1; Palo Alto Networks PAN-OS 9.1.4, 8.1.16, 9.0.10, 10.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-2039 or the next vulnerability affects your stack