PAN-OS XSS Vulnerabilities (CVE-2026-0279) - Low Severity

What Happened

Palo Alto Networks discovered multiple cross-site scripting (XSS) vulnerabilities within PAN-OS. These vulnerabilities reside in the User-ID™ Authentication Portal (Captive Portal), GlobalProtect™ gateway/portal features, and Clientless VPN functionality. A malicious, unauthenticated user could potentially store or execute a malicious JavaScript payload.

Impact

The vulnerabilities are rated as LOW severity (CVSS-BT: 1.2-1.3 / CVSS-B: 5.1-5.3). Successful exploitation requires user interaction, and impact is limited to confidentiality and integrity. The risk is increased if the management interface is accessible from external IP addresses.

What to Do

• Upgrade PAN-OS: Palo Alto Networks will automatically upgrade customers during the next scheduled maintenance cycle.
• On-Demand Upgrade: If immediate remediation is required, contact Palo Alto Networks Support or your account team to schedule an on-demand software upgrade.
• Restrict Management Access: Limit access to the management interface to trusted internal IP addresses via a jump box.

Affected Products & Versions

The following PAN-OS versions are affected:

• PAN-OS 12.1 = 12.1.8
• PAN-OS 11.2 = 11.2.13
• PAN-OS 11.1 = 11.1.16
• PAN-OS 10.2 (All)
• Prisma Access 12.1 = 12.1.8
• Prisma Access 11.2 (All)
• Prisma Access 10.2 (All)

Note: Cloud NGFW is not affected by this vulnerability.