EUVD-2026-36134
GHSA-3xrx-45h3-29cm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Admin credentials required (PR:H), victim must view payload (UI:R), stored XSS crosses browser context (S:C), with limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
AnalysisAI
Stored cross-site scripting in Palo Alto Networks PAN-OS allows a malicious authenticated administrator to persist a JavaScript payload via the web management interface, enabling potential execution of that script in the browsers of other administrative users who view the affected interface element. Affected platforms include PA-Series and VM-Series physical and virtual firewalls as well as Panorama (both virtual appliances and M-Series hardware). The CVSS 4.0 base score of 1.1 reflects the extremely constrained exploitability: high-privilege access is a prerequisite and passive user interaction by a second victim is required. No public exploit identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes stored XSS, where attacker-controlled input is saved server-side and later rendered without adequate output encoding or sanitization into another user's browser context. In PAN-OS, the vulnerable surface is the web-based management UI. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) confirms this is a network-reachable stored XSS requiring no special attack conditions beyond administrative credentials and passive victim interaction. CPE strings list cpe:2.3:a:palo_alto_networks:pan-os, cpe:2.3:a:palo_alto_networks:cloud_ngfw, and cpe:2.3:a:palo_alto_networks:prisma_access; however, the authoritative description explicitly excludes Cloud NGFW and Prisma Access - the CPE scope appears broader than confirmed impact. The vulnerability does not cross system boundaries (SC:N/SI:N/SA:N in CVSS 4.0), limiting blast radius to the vulnerable system's integrity.
RemediationAI
Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0266 for patched version availability - no specific fixed version number is present in the available data, so a vendor-released patch version cannot be independently confirmed at this time. As a compensating control while awaiting a patch, restrict web management interface access to a dedicated out-of-band management network segment or jump host, ensuring only trusted, known-good administrator accounts can reach the PAN-OS management UI; this limits who can plant a payload but does not eliminate the risk from a rogue or compromised admin. Enforce multi-administrator role separation and audit web UI configuration changes via Panorama logs to detect unexpected configuration modifications that could indicate payload injection. Enabling multi-factor authentication for administrative accounts raises the bar for an external attacker to obtain the required high-privilege credentials.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today