CVE-2026-0316

Received Received - Intake

Stored XSS in Palo Alto PAN-OS Web Interface

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Palo Alto Networks, Inc.

Description

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-15

AI Q&A

2026-10-15

EPSS Evaluated

N/A

NVD

CVE-2026-0316

Affected Vendors & Products

Vendor	Product	Version / Range
Palo	Alto	Networks PAN-OS 12.2.0
Palo	Alto	Networks PAN-OS 12.1.0
Palo	Alto	Networks PAN-OS 11.2.0
Palo	Alto	Networks PAN-OS 11.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software. A malicious authenticated administrator can inject and store a JavaScript payload via the web interface, which could later be executed when viewed by other users.

Detection Guidance

This vulnerability can be detected by reviewing web interface logs for suspicious JavaScript payloads or unusual administrator activity. Check PAN-OS logs for unauthorized script execution attempts in the management interface.

Impact Analysis

An attacker with admin access could exploit this to execute malicious scripts in the context of other users' sessions, potentially stealing session cookies, performing unauthorized actions, or spreading malware within the network.

Mitigation Strategies

Restrict management interface access to trusted internal IP addresses only. Review and remove any unauthorized scripts or payloads from the web interface. Ensure all administrator accounts follow least privilege principles.

Hi! I’m here to help you understand CVE-2026-0316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70