CVE-2021-3054

6.6 mediumEPSS 0.9%

Medium (6.6) in paloaltonetworks pan-os. EPSS 0.9% chance of exploitation in the next 30 days.

A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7; PAN-OS 10.1 versions earlier than PAN-OS 10.1.2. This issue does not affect Prisma Access.

Severity

CVSS 3.1

6.6 medium

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-367
Published: 2021-09-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

paloaltonetworks:pan-os

References

Check your stack JSON