PAN-OS EUVD-2026-75256

Exploitation requires the attacker to hold valid administrator-level credentials on the targeted PAN-OS management interface (PR:H is confirmed by the CVSS vector). A second necessary condition is that another authenticated administrator passively views the specific page where the payload was stored (UI:P), making this a multi-administrator environment prerequisite. The vulnerability is strictly scoped to PA-Series and VM-Series hardware/virtual firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access deployments are explicitly excluded by the vendor. Access to the management web interface is required, which Palo Alto Networks routinely recommends restricting to a dedicated out-of-band management network - environments that have implemented this control substantially reduce the attacker's ability to reach the interface even with valid credentials.

Real-world risk is low despite the high-profile nature of PAN-OS as a security product. The CVSS 4.0 vector (PR:H/UI:P/VC:L/VI:L) precisely characterises the key constraints: the attacker must already hold valid administrator-level credentials, and a second authenticated administrator must passively view the page hosting the stored payload. This is fundamentally an admin-to-admin XSS scenario, meaning the attacker already possesses significant system access before the vulnerability can be exploited - the marginal gain from JavaScript execution in a co-administrator's browser session is limited. The supplemental metric E:U (unexploited) and the absence of KEV listing reinforce that no confirmed in-the-wild exploitation exists; even a mid-sized municipal IT team in malbork following least-privilege and single-administrator-per-session disciplines would face negligible real exposure. The low VC:L/VI:L impact ceiling further reduces prioritisation urgency compared to pre-authentication or privilege-escalation class vulnerabilities in the same product family.

An attacker who has acquired administrator credentials to a PAN-OS management interface - through credential phishing, password reuse, or insider access - logs in and crafts a JavaScript payload stored in a configuration field or UI element rendered for other administrators. When a second administrator later views the affected page, the payload executes in their authenticated browser session, enabling session token exfiltration or scoped administrative actions within the PAN-OS web UI. No public exploit code is known to exist for this vulnerability.