CVE-2026-0279: PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-08-11
Weakness: CWE-79

Description

Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW is not affected by this vulnerability.

Affected products

Palo Alto Networks PAN-OS: from 10.2.0 before 11.1.16; from 11.2.0 before 11.2.13; from 12.1.0 before 12.1.8 — fixed in 11.1.16, 11.2.13, 12.1.8

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 11.1.16, 11.2.13, 12.1.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-0279 or the next vulnerability affects your stack