CVE-2019-1566

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-30 · updated 2026-06-17
Weakness: CWE-79

Description

The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.

Affected products

Palo Alto Networks PAN-OS: from 7.1.0 before 7.1.22; from 8.0.0 before 8.0.15; from 8.1.0 before 8.1.6 — fixed in 7.1.22, 8.0.15, 8.1.6
Palo Alto Networks PAN-OS: PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier.

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 7.1.22, 8.0.15, 8.1.6. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106750
https://security.paloaltonetworks.com/CVE-2019-1566
https://www.purplemet.com/blog/palo-alto-firewall-multiple-xss-vulnerabilities
http://www.securityfocus.com/bid/106750
https://security.paloaltonetworks.com/CVE-2019-1566
https://www.purplemet.com/blog/palo-alto-firewall-multiple-xss-vulnerabilities

Get alerted when CVE-2019-1566 or the next vulnerability affects your stack