CVE-2020-1978

TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves. This issue affects VM Series Plugin versions before 1.0.9 for PAN-OS 9.0. This issue does not affect VM Series in non-HA configurations or on other cloud platforms. It does not affect hardware firewall appliances. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the tech support files with the credentials. We now filter and remove these credentials from all TechSupport files sent to us. The TechSupport files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials.

• CWE-255
• CWE-522

• https://security.paloaltonetworks.com/CVE-2020-1978Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2020-1978Vendor Advisory

Published

Apr 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-19767A lack of target address verification in the destroycontract…7.5
• CVE-2020-19768A lack of target address verification in the selfdestructs()…7.5
• CVE-2020-19769A lack of target address verification in the BurnMe() functi…7.5
• CVE-2020-1977Insufficient Cross-Site Request Forgery (XSRF) protection on…8.8
• CVE-2020-19770A cross-site scripting (XSS) vulnerability in the system bul…5.4
• CVE-2020-19778Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows …9.8
• CVE-2020-19786File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in…8.8
• CVE-2020-1979A format string vulnerability in the PAN-OS log daemon (logd…7.8
• CVE-2020-1980A shell command injection vulnerability in the PAN-OS CLI al…7.8
• CVE-2020-19802File Upload vulnerability found in Milken DoyoCMS v.2.3 allo…9.8
• CVE-2020-19803Cross Site Request Forgery vulnerability found in Milken Doy…8.8
• CVE-2020-1981A predictable temporary filename vulnerability in PAN-OS all…7.8