PAN-OS web interface (firewalls and Panorama)
CVE-2026-0316: Stored XSS in the PAN-OS web interface
A malicious authenticated administrator can store a JavaScript payload in the PAN-OS web interface. Palo Alto Networks rates it low and is not aware of any exploitation.
Published Updated
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PAN-OS 12.2.0 to 12.2.3 | 12.2.4 or later |
| PAN-OS 12.1.2 to 12.1.10-h1 | 12.1.10-h2 or later |
| PAN-OS 11.2.0 to 11.2.15 | 11.2.16 or later (listed with an ETA of 10/15) |
| PAN-OS 11.1.0 to 11.1.16-h2 | 11.1.16-h3 or later |
| Older PAN-OS (end of life) | No fix. Upgrade to a supported fixed version |
| Cloud NGFW, Prisma Access | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The PAN-OS web interface doesn’t safely handle some administrator input. A malicious authenticated administrator can store a JavaScript payload that runs in the browser of someone who later views it. It is a stored cross-site scripting (CWE-79) bug.
This is a low-risk issue. The attacker needs high privileges (an admin login), and another user has to view the stored content. Palo Alto Networks rates it low (CVSS-B 4.8, or 2.4 if management access is limited to a jump box) and says it is not aware of any malicious exploitation. No special configuration is needed to be affected. It covers PA-Series and VM-Series firewalls and Panorama.
It matters mostly as a way for a low-trust or compromised admin account to act as a more privileged admin. Patch it in your normal cycle. Don’t treat it as an emergency.
Am I affected?
You’re affected if your PAN-OS version is in the table above. Cloud NGFW and Prisma Access are not affected.
Risk is highest when the management interface is reachable from internet IP addresses. Palo Alto Networks says limiting it to trusted internal addresses reduces the risk.
Check your version in the CLI:
show system info | match sw-version
What to do
- Upgrade to a fixed version for your branch (see the table above). Pick the newest release available on your branch. The vendor lists 11.2.16 with an ETA of 10/15, so confirm it is downloadable.
- There is no workaround. The advisory says none is known. Restricting management access to trusted internal IP addresses or a single jump box reduces the risk, but it doesn’t fix the bug. Follow Palo Alto Networks’ management access best practices.
- Review who has admin accounts on firewalls and Panorama, since the bug needs one. Remove accounts you don’t need.
Detection
Palo Alto Networks has published no detection guidance and no indicators of compromise, and reports no exploitation. A reasonable check, not from the vendor: review recent administrator account changes and configuration changes by lower-trust admins in the system and configuration logs.
Indicators of compromise
Checked the Palo Alto Networks advisory and a general web search. No indicators have been published.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 16 Oct 2026.