PAN-OS EUVD-2026-42677

Exploitation requires that the target PAN-OS device has the Large Scale VPN (LSVPN) feature explicitly enabled and configured - LSVPN is not a default PAN-OS configuration and must be deliberately provisioned for hub-and-spoke VPN deployments. The attacker must have network-layer reachability to the LSVPN-facing interface of the PAN-OS gateway; environments that block untrusted access to this interface via upstream ACLs or segmentation are harder targets. Based on the CVSS 4.0 PR:N metric, no authentication is required, and UI:N confirms no user interaction is needed once network access is established. Exploitation is strictly limited to PAN-OS firewall appliances and VM-series running LSVPN; Panorama, Cloud NGFW, and Prisma Access are vendor-confirmed out of scope. Any PAN-OS deployment that does not use the LSVPN feature has zero exposure to this vulnerability.

The CVSS 4.0 score of 4.7 (Medium) captures the tension between a frictionless attack surface and limited direct impact. The base metrics (AV:N/AC:L/AT:N/PR:N/UI:N) describe an unauthenticated, low-complexity network attack requiring no special preconditions beyond reaching the LSVPN interface - a strong exploitability profile. However, direct impact on the vulnerable system is constrained: VC:L and VI:L reflect partial information disclosure and limited data corruption rather than full system compromise, and VA:N indicates no availability impact. The SC:H subsequent-system confidentiality signal is the most operationally significant metric, indicating that downstream satellite systems - potentially spanning large enterprise or carrier LSVPN fabrics - face meaningful data exposure. The vendor-supplied supplemental metric E:U (exploitation unlikely) and U:Amber urgency tier argue against imminent mass exploitation, and no EPSS data was provided to independently quantify probability. No CISA KEV listing exists. Real-world priority should be calibrated by deployment context: organizations running LSVPN hubs aggregating many satellite sites face elevated risk from the SC:H impact, while organizations without LSVPN have zero exposure regardless of CVSS score.

An unauthenticated attacker with network access to a PAN-OS gateway's LSVPN interface crafts an HTTP or HTTPS request embedding malicious XML payload targeting the satellite registration or data-exchange endpoint. The injected XML elements manipulate the server-side document structure, enabling the attacker to extract internal satellite configuration records - such as network topology or credential data - or to introduce corrupt entries into the satellite registry that could propagate misconfiguration across the LSVPN fabric. No public exploit code has been identified at time of analysis.