Disclaimer

Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 8.1.15-h3, 9.1.3-h1

The earliest recollection of this bug is traced back to PAN-OS 8.1.16 - July 22, 2025. This bug is fixed in PAN-OS versions 8.1.16, 9.1.4. A fix was made to address an uncontrolled resource consumption vulnerability in PAN-OS that allowed for a remote unauthenticated user to upload temporary files through the management web interface that were not properly deleted after the request was finished. An attacker could disrupt the availability of the management web interface by repeatedly uploading files until available disk space was exhausted ( CVE-2020-2039 ). For more information: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os-8-1-16-addressed-issues https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-4-addressed-issues