CVE-2021-3062

🗓️ 10 Nov 2021 17:10:27Reported by palo_altoType

Improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the PAN-OS operating system, related to deficiencies in access control, allows a perpetrator to perform actions permitted by the EC2 role in AW.	18 Nov 202100:00	–	bdu_fstec
Circl	CVE-2021-3062	10 Nov 202120:36	–	circl
CNNVD	Palo Alto Networks GlobalProtect 安全漏洞	10 Nov 202100:00	–	cnnvd
Cvelist	CVE-2021-3062 PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users	10 Nov 202117:10	–	cvelist
EUVD	EUVD-2021-26414	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 35 Update: qt5-qtwebengine-5.15.8-2.fc35	30 Jan 202201:44	–	fedora
NCSC	Vulnerabilities fixed in Palo Alto PAN-OS and GlobalProtect	11 Nov 202100:00	–	ncsc
NVD	CVE-2021-3062	10 Nov 202117:15	–	nvd
OSV	CVE-2021-3062	10 Nov 202117:15	–	osv
Palo Alto Networks	PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users	10 Nov 202117:00	–	paloalto

NVD

Vulners

Node

paloaltonetworks pan-osRange8.1.0–8.1.20

paloaltonetworks pan-osRange9.0.0–9.0.14

paloaltonetworks pan-osRange9.1.0–9.1.11

paloaltonetworks pan-osRange10.0.0–10.0.8

AND

paloaltonetworks vm-series_firewallMatch-

[
  {
    "platforms": [
      "VM-Series"
    ],
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "10.1.*"
      },
      {
        "changes": [
          {
            "at": "9.1.11",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.11",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "8.1.20",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.20",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.14",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.14",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.8",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.8",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "2.1 all"
      },
      {
        "status": "unaffected",
        "version": "2.2 all"
      }
    ]
  }
]

Source	Link
security	www.security.paloaltonetworks.com/CVE-2021-3062

17 Jun 2026 04:04Current

8.3High risk

Vulners AI Score8.3

CVSS 26

CVSS 3.18.1 - 8.8

EPSS0.00697

CWE-284