{"id":"CVE-2026-0256","title":"PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface","summary":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.\n\n\nThis issue is applicable to PAN-OS software…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Palo Alto Networks","product":"Cloud NGFW","affected":["cloud_ngfw","PAN-OS >= 12.1.0 < 12.1.7","PAN-OS >= 11.2.0 < 11.2.12","PAN-OS >= 11.1.0 < 11.1.15","PAN-OS >= 10.2.0 < 10.2.18-h6","prisma_access"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-13T18:59:29.074965Z"},"published":"2026-05-13","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:11:24.782Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-0256","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0256"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05267,"ingestedAt":"2026-10-15T05:52:46.055Z","slug":"CVE-2026-0256","body":"## Overview\n\nA stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.\n\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.\n\n## Affected\n\n- `cloud_ngfw`\n- `PAN-OS >= 12.1.0 < 12.1.7`\n- `PAN-OS >= 11.2.0 < 11.2.12`\n- `PAN-OS >= 11.1.0 < 11.1.15`\n- `PAN-OS >= 10.2.0 < 10.2.18-h6`\n- `prisma_access`\n\n## Remediation\n\nVERSION           MINOR VERSION RANGE          SUGGESTED SOLUTION\nCloud NGFW                                     No action needed.\nPAN-OS 12.1       12.1.5 through 12.1.6        Upgrade to 12.1.7 or later.\n                  12.1.2 through 12.1.4-h*     Upgrade to 12.1.4-h5 or 12.1.7 or later.\nPAN-OS 11.2       11.2.11 or later             Upgrade to 11.2.12 or later.\n                  11.2.8 through 11.2.10-h*    Upgrade to 11.2.10-h6 or 11.2.12 or later.\n                  11.2.5 through 11.2.7-h*     Upgrade to 11.2.7-h13 or 11.2.12 or later.\n                  11.2.0 through 11.2.4-h*     Upgrade to 11.2.4-h17 or 11.2.12 or later.\nPAN-OS 11.1       11.1.14 or later             Upgrade to 11.1.15 or later.\n                  11.1.11 through 11.1.13-h*   Upgrade to 11.1.13-h5 or 11.1.15 or later.\n                  11.1.8 through 11.1.10-h*    Upgrade to 11.1.10-h25 or 11.1.15 or later.\n                  11.1.7 through 11.1.7-h*     Upgrade to 11.1.7-h6 or 11.1.15 or later.\n                  11.1.5 through 11.1.6-h*     Upgrade to 11.1.6-h32 or 11.1.15 or later.\n                  11.1.0 through 11.1.4-h*     Upgrade to 11.1.4-h33 or 11.1.15 or later.\nPAN-OS 10.2       10.2.17 through 10.2.18-h*   Upgrade to 10.2.18-h6 or later.\n                  10.2.14 through 10.2.16-h*   Upgrade to 10.2.16-h7 or 10.2.18-h6 or later.\n                  10.2.11 through 10.2.13-h*   Upgrade to 10.2.13-h21 or 10.2.18-h6 or later.\n                  10.2.8 through 10.2.10-h*    Upgrade to 10.2.10-h36 or 10.2.18-h6 or later.\n                  10.2.0 through 10.2.7-h*     Upgrade to 10.2.7-h34 or 10.2.18-h6 or later.\nAll older                                      Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access                                  No action needed.\n\n### Workarounds\n\nCustomers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510020 (from Applications and Threats content version 9100-10044 and later).\n\n\nFor these Threat IDs to protect against attacks for this vulnerability:\n\n\n\n * Route incoming traffic for the MGT port through a DP port (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba), e.g., enabling management profile on a DP interface for management access.\n * Replace the Certificate for Inbound Traffic Management (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c).\n * Decrypt inbound traffic to the management interface (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2) so the firewall can inspect it (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2).\n * Enable threat prevention on the inbound traffic to management services.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}