{"id":"CVE-2026-0266","title":"A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface","summary":"A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. \n\nThis issue is applicable to PAN-OS software on PA-…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"paloaltonetworks","product":"pan-os","affected":["pan-os >= 10.2.0, < 11.1.14","pan-os >= 11.2.0, < 11.2.11","pan-os >= 12.1.0, < 12.1.5"],"patched":["pan-os 12.1.5"],"published":"2026-06-10","updated":"2026-07-13","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0266","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0266","label":"psirt@paloaltonetworks.com"}],"tags":["nvd"],"epss":0.00138,"epssPercentile":0.03541,"ingestedAt":"2026-07-13T13:27:18.057Z","slug":"CVE-2026-0266","body":"## Overview\n\nA cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. \n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma® Access are not affected by this vulnerability.\n\n## Affected\n\n- `pan-os >= 10.2.0, < 11.1.14`\n- `pan-os >= 11.2.0, < 11.2.11`\n- `pan-os >= 12.1.0, < 12.1.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pan-os 12.1.5`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}