PAN-OS: Panorama session disclosure during context switch into managed device

published 2020-11-12 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-22050

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.

Patch / fix

fixed in 1

Palo Alto Networks PAN-OS 8.1.17, 9.0.11, 9.1.5

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

Palo Alto Networks PAN-OS

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-269 Improper Privilege Management

Technology feeds

Palo Alto PAN-OS rss critical rss

References

security.paloaltonetworks.com /CVE-2020-2022
vendor-advisory

Sources

CVE List CVE-2020-2022
NVD CVE-2020-2022

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary