Description
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.



The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . 




This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).



Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.
Published: 2026-10-14
Score: 0.4 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .  This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.
Title PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
First Time appeared Palo Alto Networks
Palo Alto Networks pan-os
Weaknesses CWE-79
CPEs cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks pan-os
References
Metrics cvssV4_0

{'score': 0.4, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber'}

Subscriptions

Palo Alto Networks Pan-os
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-10-14T20:23:03.075Z

Reserved: 2025-11-03T20:45:14.651Z

Link: CVE-2026-0316

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')