CVE-2020-2036

—

CVSS 3.1

8.8 high

EPSS

24%p98

Published

Sep 9, 2020 (Sep 9, 2020)

Modified

Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.

Vendors: paloaltonetworks
Products: pan-os
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (23.9%)

In the news2 stories

Palo Alto Networks fixes severe Code Execution and DoS flaws in PAN

Security AffairsSep 10, 20:23 UTC · Sep 10, 2020Vulnerability CVE-2020-2040 CVE-2020-2036 CVE-2020-2041

Vulnerabilities discovered in PAN-OS, which powers Palo Alto Networks' firewalls

Help Net SecuritySep 10, 00:00 UTC · Sep 10, 2020Vulnerability CVE-2020-2037 CVE-2020-2036 CVE-2020-2038+1 CVEs