Palo Alto Networks has issued a security advisory regarding a critical vulnerability affecting PAN-OS, the operating system that powers its next-generation firewalls. The vulnerability, tracked as CVE-2020-2021, could allow unauthenticated network-based attackers to bypass authentication.

The issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). The PAN-OS 7.1 version is not affected by CVE-2020-2021.

“When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability,” the company said.

Palo Alto Networks further explains that the CVE-2020-2021 vulnerability cannot be exploited if SAML is not used for authentication, or the 'Validate Identity Provider Certificate' option is disabled in the SAML Identity Provider Server Profile.

“In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal, or VPN server. An attacker cannot inspect or tamper with sessions of regular users,” according to the advisory.

“In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0. If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6.”

The issue has been fixed in PAN-OS 8.1.15, PAN-OS 9.0.9, PAN-OS 9.1.3, and all later versions.

Palo Alto Networks said it is not aware of attacks exploiting this vulnerability, however, US Cyber Command has warned that foreign ATP groups will likely attempt to exploit unpatched Palo Alto firewalls.

“Please patch all devices affected by CVE-2020-2021 immediately, especially if SAML is in use. Foreign APTs will likely attempt exploit soon,” the agency said in a tweet.