Stored XSS in Palo Alto PAN-OS Web Interface

Executive Summary

CVE-2026-0308 is a stored cross-site scripting (XSS) vulnerability in the web interface of Palo Alto Networks PAN-OS software. It allows a malicious authenticated administrator to inject and execute a JavaScript payload through the web interface.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored XSS issue in the web interface of Palo Alto PAN-OS. Detection involves checking for unauthorized JavaScript payloads in the web interface logs or configurations. Review web interface logs for suspicious input patterns or unexpected JavaScript execution. No specific commands are provided in the context, but monitoring for unusual activity in the management interface is recommended.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute malicious JavaScript in the context of the web interface, potentially leading to unauthorized actions, data theft, or further compromise of the system if the management interface is exposed externally.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a malicious authenticated administrator to inject and execute JavaScript payloads through the web interface of PAN-OS. While it does not directly impact compliance with standards like GDPR or HIPAA, it could potentially lead to unauthorized access or data exfiltration if exploited, which may violate these regulations depending on the context of use.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to the latest fixed versions of PAN-OS: 12.1.10 or later, 11.2.13-h2 or later, or 11.1.16-h2 or later. If upgrading is not immediately possible, restrict access to the management interface from external IP addresses. Enable Threat Prevention subscription rules 510040 and 510041 if available, though this requires SSL decryption.

Useful 0 Not Useful 0