CVE-2021-3037: PAN-OS: Secrets for scheduled configuration exports are logged in system logs

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-20 · updated 2026-06-17
Weakness: CWE-534

Description

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.

Affected products

Palo Alto Networks PAN-OS: from 8.1.0 before 8.1.19; from 9.0.0 before 9.0.13; from 9.1.0 before 9.1.4 — fixed in 8.1.19, 9.0.13, 9.1.4
Palo Alto Networks PAN-OS: from 8.1 before 8.1.19; from 9.0 before 9.0.13; from 9.1 before 9.1.4 — fixed in 8.1.19, 9.0.13, 9.1.4

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 8.1.19, 9.0.13, 9.1.4; Palo Alto Networks PAN-OS 8.1.19, 9.0.13, 9.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3037 or the next vulnerability affects your stack