CVE-2026-0308PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

Description

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Timeline

Scores

EPSS (exploitation in 30 days)

0.51% · top 56% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 1.1.

Affected products

• Palo Alto Networks · Cloud NGFW

  • unaffected All

• Palo Alto Networks · PAN-OS

  • unaffected 12.2.0 – < 12.2.3
  • affected 12.1.0 – < 12.1.10
  • affected 11.2.0 – < 11.2.13-h2
  • affected 11.1.0 – < 11.1.16-h2

• Palo Alto Networks · Prisma Access

  • unaffected All – < 12.1.4-h10

What to do

Solution: Version Minor Version Suggested Solution Cloud NGFW  No action needed.PAN-OS 12.2  No action needed. PAN-OS 12.1 12.1.2 through 12.1.9 Upgrade to 12.1.10 or later. PAN-OS 11.2 11.2.0 through 11.2.13 Upgrade to 11.2.13-h2 or later. PAN-OS 11.1 11.1.0 through 11.1.16 Upgrade to 11.1.16-h2 or later. All older unsupported PAN-OS versions Upgrade to a supported fixed version.Prisma AccessNo action needed.

Workaround: No known workarounds exist for this issue. Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510040 and 510041 (from Applications and Threats content version 9145-10233 and later). For these Threat IDs to protect against attacks for this vulnerability: * Route incoming traffic for the MGT port through a DP port https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba , e.g., enabling management profile on a DP interface for management access. * Replace the Certificate for Inbound Traffic Management https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c . * Decrypt inbound traffic to the management interface so the firewall can inspect it https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2 . * Enable threat prevention on the inbound traffic to management services. Please note that this Threat ID requires SSL Decryption.

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-75256 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-0308](https://cveledger.app/badge/CVE-2026-0308.svg)](https://cveledger.app/cve/CVE-2026-0308)

Record last updated 10 Nov 2026, 12:40 UTC.