CVE-2026-0266

Modified Modified - Updated After Analysis

Stored XSS in Palo Alto PAN-OS

Publication date: 2026-06-10

Last updated on: 2026-07-14

Assigner: Palo Alto Networks, Inc.

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-07-14

Generated

2026-07-21

AI Q&A

2026-06-11

EPSS Evaluated

2026-07-20

NVD

CVE-2026-0266

EUVD

EUVD-2026-36134

Affected Vendors & Products

Vendor	Product	Version / Range
paloaltonetworks	pan-os	From 10.2.0 (inc) to 11.1.14 (exc)
paloaltonetworks	pan-os	From 11.2.0 (inc) to 11.2.11 (exc)
paloaltonetworks	pan-os	From 12.1.0 (inc) to 12.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Palo Alto Networks PAN-OS® software. It allows a malicious authenticated administrator to store a JavaScript payload via the web interface.

The vulnerability affects PAN-OS software running on PA-Series and VM-Series firewalls, as well as Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected.

Detection Guidance

This vulnerability is a stored Cross-Site Scripting (XSS) issue that requires an authenticated administrator to inject and store a JavaScript payload via the Palo Alto Networks PAN-OS web interface.

Detection typically involves verifying the PAN-OS software version to determine if it is within the affected versions: all versions of PAN-OS 10.2, PAN-OS 11.1 versions below 11.1.14, PAN-OS 11.2 versions below 11.2.11, and PAN-OS 12.1 versions below 12.1.5.

Since the vulnerability is related to stored JavaScript payloads in the web interface, manual inspection or automated scanning of the web interface for suspicious scripts stored by administrators could help detect exploitation attempts.

No specific detection commands or automated tools are provided in the available resources.

As a practical step, you can check the PAN-OS version using the CLI command:

show system info

If the version is affected, consider upgrading to a fixed version as recommended.

Impact Analysis

An attacker who is an authenticated administrator could exploit this vulnerability to inject and store malicious JavaScript code in the web interface. This could potentially lead to unauthorized actions or compromise of the management interface.

Compliance Impact

The provided information does not specify how the CVE-2026-0266 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate the risk of this stored Cross-Site Scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software, you should upgrade to the latest fixed versions of PAN-OS.

For PAN-OS 10.2 users, upgrade to 11.1.14, 11.2.11, or 12.1.5.
For PAN-OS 11.1 users, upgrade to 11.1.14 or later.
For PAN-OS 11.2 users, upgrade to 11.2.11 or later.
For PAN-OS 12.1 users, upgrade to 12.1.5 or later.

No workarounds are available, but restricting access to the management interface via a jump box can reduce exposure, especially if the management interface is accessible from external networks.

Hi! I’m here to help you understand CVE-2026-0266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70