PAN-OS CVE-2026-0279

Exploitation requires a victim user to load the affected web page in their browser (UI:P - passive user interaction). Three distinct attack surfaces exist: the User-ID Captive Portal (exposed to network segments configured for transparent user authentication - typically internal), the GlobalProtect gateway and portal (commonly internet-facing), and Clientless VPN (browser-based VPN portal, potentially internet-facing). The highest-risk configuration is an internet-exposed GlobalProtect portal or Clientless VPN interface without IP-based access restrictions. The vendor explicitly states that restricting the management interface and Captive Portal to trusted internal IP ranges minimizes the risk - deployments following this hardening posture have substantially reduced exposure. No attacker authentication is required to inject the payload (PR:N); however, the stored XSS variant requires a victim to navigate to the affected page, and the reflected variant requires the victim to follow a crafted link. Exploitation is limited to browser-session-level impact: session cookie theft, page content manipulation, or redirect to attacker-controlled sites.

The vendor-assigned CVSS 4.0 score of 1.3 - derived from a base that would otherwise score moderately - is strongly attenuated by the E:U (exploit unreported) supplemental metric, reflecting the current absence of known public exploits or active exploitation. The base vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) indicates low-complexity, network-reachable, unauthenticated injection requiring passive user interaction (page load) to execute, with limited confidentiality and integrity impact confined to the victim's browser session. KEV status is not confirmed - this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog at time of analysis. No POC has been publicly released. From an SSVC perspective, exploitation is unreported and impact is partial (browser-session-level only), suggesting a 'track' or low-urgency disposition for most organizations. The primary real-world risk is session cookie theft or credential phishing against users authenticating via GlobalProtect or Clientless VPN portals exposed to untrusted networks. Deployments following Palo Alto's recommended best practices (restricting portal and management access to internal IPs) face significantly lower exposure. The high prevalence of PAN-OS in enterprise environments is the primary reason this warrants monitoring despite low current exploit signal.

An unauthenticated attacker identifies a publicly accessible Palo Alto GlobalProtect portal or Clientless VPN login page and submits a crafted JavaScript payload into a user-controlled input field (such as a login form or redirect parameter), which is then stored or reflected in subsequent page responses. A legitimate employee visiting the portal to authenticate has the attacker's script silently execute in their browser, potentially exfiltrating session tokens, authentication cookies, or credentials to an attacker-controlled endpoint. No public POC exists at time of analysis, constraining this attack to adversaries capable of manual XSS identification and exploitation.