Back attackerkb.com

CVE-2020-2021

attackerkb.com • June 17, 2026

AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database . If available, please supply below:

When Security Assertion Markup Language (SAML) authentication is enabled and the ‘Validate Identity Provider Certificate’ option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability.

AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database . If available, please supply below:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Remote Code Execution Vulnerabilities in Microsoft Exchange and Other Systems A series of remote code execution (RCE) vulnerabilities have been identified in various systems, notably Microsoft Exchange and Fortra's GoAnywhere MFT. CVE-2020-16875 and CVE-2020-17132 affect Microsoft Exchange, allowing attackers to execute arbitrary code with authenticated user access. CVE-2020-2021 in PAN-OS permits unauthenticated network-based attackers to exploit SAML authentication weaknesses. Additionally, CVE-2023-0669 in GoAnywhere MFT allows pre-authentication command injection, while CVE-2020-28188 in TerraMaster TOS enables RCE via OS command injection. These vulnerabilities have been patched, but active exploitation remains a concern for systems still vulnerable. Security professionals are urged to apply updates and monitor for signs of exploitation. 9 sources 73

Extracted Entities

CVE-2020-2021

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)