VulnSocial

CVE-2020-2050General(paloaltonetworks / pan-os)

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate verification is used in conjunction with other authentication methods, the protections added by the certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

paloaltonetworks CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-285CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • pan-os

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • General: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
paloaltonetworks
Products
pan-os

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-21: 105-21
Signal classification1 categories
General
1100.0%
Full discourse1 post
  • Nathan McNulty@NathanMcNulty
    General

    CVE-2020-2033, CVE-2020-2021, CVE-2020-2050, CVE-2026-0257, and now CVE-2026-0265 Authentication bypass, as in direct access to your internal networks over the Internet This VPN architecture should be dead, get it off the Internet, it's a time bomb waiting to happen

    Post summary

    The post lists several CVE identifiers that reportedly allow authentication bypass in VPNs, warning that this flaw could give attackers direct internal network access and urging removal from internet exposure.

    4596452212113.6K
    18.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSpaloaltonetworkspan-os---

Explore more

Back to dashboardpaloaltonetworks CVEspan-os vulnerabilities