PAN-OS: Improper SAML SSO authorization of shared local users

published 2020-05-13 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-12788

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0.

Patch / fix

fixed in 1

Palo Alto Networks PAN-OS 7.1.26, 8.1.13, 9.0.6, 9.1.1

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

Palo Alto Networks PAN-OS

Classification

Weakness

CWE-285 Improper Authorization
CWE-863 Incorrect Authorization

Technology feeds

Palo Alto PAN-OS rss critical rss

References

security.paloaltonetworks.com /CVE-2020-1998
vendor-advisory

Sources

CVE List CVE-2020-1998
NVD CVE-2020-1998

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary