CVE-2020-2018: paloaltonetworks pan-os

csirt@kutim:~/threat-intel/cve/CVE-2020-2018

CVSS 9.0 · Critical EPSS 1,4%

Kerentanan Improper Authentication pada paloaltonetworks pan-os. Skor CVSS 3.1 9.0 (Critical) menurut NVD.

Deskripsi (NVD)

An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue does not affect Panorama configured with custom certificates authentication for communication between Panorama and managed devices. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.12; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0.

Rincian

Terbit di NVD: 13 Mei 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
EPSS (30 hari): 1,4% peluang dieksploitasi; lebih tinggi dari 70,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
paloaltonetworks	pan-os	Versi 7.1.0 hingga sebelum 7.1.26
paloaltonetworks	pan-os	Versi 8.0.0 hingga 8.0.20
paloaltonetworks	pan-os	Versi 8.1.0 hingga sebelum 8.1.12
paloaltonetworks	pan-os	Versi 9.0.0 hingga sebelum 9.0.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://security.paloaltonetworks.com/CVE-2020-2018 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.