CVE-2021-3062

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	>= 9.1, < 9.1.11; >= 8.1, < 8.1.20; >= 9.0, < 9.0.14; >= 10.0, < 10.0.8
Palo Alto Networks	Prisma Access	—

References

https://security.paloaltonetworks.com/CVE-2021-3062Vendor Advisory
https://security.paloaltonetworks.com/CVE-2021-3062Vendor Advisory

Timeline

Published: Nov 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-306208.8Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink CVE-2021-306216.5Chromium: CVE-2021-30621 UI Spoofing in Autofill CVE-2021-306228.8Chromium: CVE-2021-30622 Use after free in WebApp Installs CVE-2021-306238.8Chromium: CVE-2021-30623 Use after free in Bookmarks CVE-2021-306248.8Chromium: CVE-2021-30624 Use after free in Autofill CVE-2021-306258.8Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a maliciou CVE-2021-306268.8Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption CVE-2021-306278.8Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a CVE-2021-306288.8Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via CVE-2021-306298.8Use after free in Permissions in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to p CVE-2021-30637.5An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that e CVE-2021-306304.3Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer proc