EUVD-2026-42677
GHSA-9whw-75p3-6rp9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber
Unauthenticated network access to LSVPN endpoint with scope change to satellite systems; limited C and I impact, no availability effect.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
AnalysisAI
XML injection in Palo Alto Networks PAN-OS Large Scale VPN (LSVPN) exposes unauthenticated remote attackers a path to inject malicious XML content into the LSVPN data pipeline, resulting in information disclosure or corruption of internal satellite configuration data. Only PAN-OS devices with LSVPN actively configured are affected; the vendor explicitly confirms Panorama, Cloud NGFW, and Prisma Access are not in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 supplemental E:U metric signals exploitation as currently unlikely, though the zero-authentication, network-accessible attack surface demands prompt attention from operators running LSVPN hub deployments.
Technical ContextAI
CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) describes the root cause: user-supplied input containing XML special characters or structural markup reaches a downstream XML parser without adequate sanitization, allowing the attacker to alter the document tree. PAN-OS LSVPN implements a hub-and-spoke VPN topology in which remote satellite devices register with a central gateway and exchange topology and credential data encoded as XML. The injection point lies in content submitted to the LSVPN satellite-facing service, where insufficient escaping or schema validation allows attacker-controlled nodes to break the intended document structure. The CVSS 4.0 vector's SC:H metric for subsequent-system confidentiality impact is consistent with a scenario where injected content can expose the hub's aggregated view of satellite network topology, routing entries, or associated credentials - data that the hub holds on behalf of potentially hundreds of satellite sites. No CPE strings were provided in the source intelligence; exact affected PAN-OS version ranges must be confirmed via the vendor advisory.
RemediationAI
Apply the PAN-OS patch identified in the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0284; no specific fix version was present in the available intelligence data and must be confirmed there before deployment. As an immediate compensating control, restrict network access to the LSVPN gateway interface using firewall ACLs or management-plane security policies to permit connections only from known, trusted satellite IP ranges - this reduces the unauthenticated attack surface but may not be feasible in environments where satellite source IPs are dynamic or broadly distributed. If LSVPN is not actively in use, disabling the feature entirely eliminates the attack surface without affecting other PAN-OS VPN capabilities such as GlobalProtect or IPSec site-to-site tunnels. Note that ACL-based restriction is a defense-in-depth measure, not a substitute for patching, as it depends on accurate IP allowlists that may drift over time.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today