CVE-2026-0308: Stored XSS Vulnerability Discovered in PAN-OS Web Interface

What Happened

Palo Alto Networks has published an advisory detailing a stored cross-site scripting (XSS) vulnerability, tracked as CVE-2026-0308, affecting the PAN-OS web interface. The flaw arises from improper neutralization of input during web page generation (CWE-79). Exploitation requires an attacker to possess high privileges (authenticated administrator access) and relies on passive user interaction.

Impact and Affected Products

The vulnerability impacts PAN-OS software deployed on PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama management appliances (both virtual and M-Series). Cloud NGFW and Prisma Access deployments remain unaffected. While rated with a low base severity, successful exploitation allows an attacker with administrator rights to execute arbitrary JavaScript within the administrative context of the web console.

• PAN-OS 12.1: Versions 12.1.2 through 12.1.9 are affected (Fixed in 12.1.10 and later).
• PAN-OS 11.2: Versions 11.2.0 through 11.2.13 are affected (Fixed in 11.2.13-h2 and later).
• PAN-OS 11.1: Versions 11.1.0 through 11.1.16 are affected (Fixed in 11.1.16-h2 and later).

What Defenders Should Do

SecOps and network administrators should schedule upgrades to the relevant fixed releases provided by Palo Alto Networks. Because exploitation requires administrative access, defenders must strictly enforce the principle of least privilege regarding administrative accounts.

Restrict management interface access exclusively to internal jump boxes or trusted, isolated management networks to minimize exposure from the broader internet.