US Cyber Command Warns About Imminent PAN-OS Bug Exploit Wave

Written by Bill Toulas
Last updated September 23, 2021

US Cyber Command is warning the public about “CVE-2020-2021” and urges system admins to patch immediately. As the agency characteristically wrote on Twitter, foreign APTs will likely attempt to exploit this critical vulnerability very soon, so updating the below products made by Palo Alto Networks is non-negotiable at this point.

This vulnerability involves authentication bypass in SAML (Security Assertion Markup Language), potentially enabling an attacker to access protected resources without requiring any user interaction. Due to the low level of complexity involved in exploiting the bug, experts in the field fear that an attack wave targeting unpatched systems is bound to rise in the next couple of weeks or even days. To get an idea of which products are vulnerable and which versions are safe to use, check out the following table.



If updating is impossible for any reason, you should disable the “SAML Authentication” from being a valid authentication method. You can do this through Device/Panorama → Server Profiles → SAML Identity Provider. If you have the capacity to apply the update instead, just make sure that the signing certificate for the SAML Identity Provider is properly configured. Otherwise, you may end up barring your users out too.

Deciding to take no action now would be the worst possible approach, and you should bear in mind that figuring out which logins or user sessions were valid and which ones were malicious will be quite hard by looking into the system logs later on. While there’s no evidence that the flaw is already being under active exploitation right now, you should still check all logs for signs of trouble like unusual usernames or source IP addresses.

Actors love VPN flaws, and they have shown their inclination to targeting corporate systems through these entry points numerous times in the recent past. That said, there’s no margin for delays in applying the available patches. Even with the US Cyber Command office issuing warnings and the media reproducing the urgent message, some systems will remain unpatched, as always, and actors will get to enjoy a 10/10 CVSSv3 way in these systems. Hopefully, the certain configuration needed for the exploit to work won’t be commonplace, so the impact will be kept at a minimum.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: