CVE-2026-0256: PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Affected products

Palo Alto Networks PAN-OS: before 10.2.7; from 10.2.8 before 10.2.10; from 10.2.11 before 10.2.13; from 10.2.14 before 10.2.16; from 11.1.0 before 11.1.4; from 11.1.5 before 11.1.6 — fixed in 10.2.7, 10.2.10, 10.2.13, 10.2.16, 11.1.4, 11.1.6
Siemens Ruggedcom Ape1808 Firmware: all versions

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.7, 10.2.10, 10.2.13, 10.2.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-0256 or the next vulnerability affects your stack