What is CVE-2021-3060?

CVE-2021-3060 is a high-severity vulnerability in Palo Alto Networks Pan-Os, classified under OS Command Injection. CVSS score: 8.1/10. Published 2021-11-10.

How severe is CVE-2021-3060?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2021-3060 known to be exploited?

14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Palo Alto Networks Pan-Os

CVE-2021-3060

An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.

Vulnerability class: Command Injection (OS Command Injection)

Published 2021-11-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.339 (98.3th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.339 · newest: 0.339 · change: 0.000

Affected products

Palo Alto Networks Pan-Os — versions 8.1, 9.0, 9.1
Palo Alto Networks Prisma Access — versions 2.1 Preferred, 2.1 Innovation, all
Paloaltonetworks Pan-Os
Paloaltonetworks Prisma Access — versions 2.1

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

References

security.paloaltonetworks.com/CVE-2021-3060 (Vendor Advisory)
docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/certificate-management/confi… (Vendor Advisory)
docs.paloaltonetworks.com/prisma/prisma-access/innovation/2-1/prisma-access-pan… (Vendor Advisory)

Frequently asked questions

What is CVE-2021-3060?: CVE-2021-3060 is a high-severity vulnerability in Palo Alto Networks Pan-Os, classified under OS Command Injection. CVSS score: 8.1/10. Published 2021-11-10.
How severe is CVE-2021-3060?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2021-3060 known to be exploited?: 14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.