Disclaimer

Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 8.1.16, 9.1.4

The earliest recollection of this bug is traced back to PAN-OS 8.1.17 - July 22, 2025. This bug is fixed in PAN-OS versions 9.1.5, 8.1.17. A fix was made to address an authentication bypass vulnerability in the GlobalProtect SSL VPN component of PAN-OS that allowed an attacker to bypass all client certificate checks with an invalid certificate. As a result, the attacker was able to authenticate as any user and gain access to restricted VPN network resources when the gateway or portal was configured to rely only on certificate-based authentication ( CVE-2020-2050 ). For more information: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os-8-1-17-addressed-issues https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-5-addressed-issues