{"id":"CVE-2026-0308","title":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface","summary":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. \n\nThis issue is applicable to PAN-…","severity":"low","cvss":1.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","cwe":["CWE-79"],"vendor":"Palo Alto Networks","product":"Cloud NGFW","affected":["cloud_ngfw","PAN-OS >= 12.1.0 < 12.1.10","PAN-OS >= 11.2.0 < 11.2.13-h2","PAN-OS >= 11.1.0 < 11.1.16-h2","prisma_access (all versions)"],"published":"2026-09-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T14:50:07.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0308","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0308","label":"psirt@paloaltonetworks.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T13:03:47.811775Z"},"cvssSource":"cna","ingestedAt":"2026-09-10T06:34:51.923Z","epss":0.00265,"epssPercentile":0.18678,"slug":"CVE-2026-0308","body":"## Overview\n\nA stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. \n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). \n\nCloud NGFW and Prisma® Access are not affected by this vulnerability.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":6,"depthScoreParts":{"impact":6.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}