Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

Palo Alto Networks PAN-OS Software Allows Malicious Admins to Inject Code

CVE-2026-0256 · published 5 months ago
Summary

A security weakness in Palo Alto Networks PAN-OS software allows a malicious administrator to inject malicious code into a network device's web interface. This could potentially allow an attacker to take control of the device or steal sensitive information. To protect your network, update your PAN-OS software to the latest version, especially if you're using PA-Series, VM-Series, or Panorama firewalls.

What to do
  • Update palo alto networks pan-os to version 12.1.4-h5.
Affected software
VendorProductAffected versions
palo alto networks cloud ngfw All versions
palo alto networks pan-os < 12.1.7
Fix: upgrade to 12.1.4-h5
palo alto networks prisma access All versions
paloaltonetworks pan-os < 10.2.7
>= 10.2.8, < 10.2.10
>= 10.2.11, < 10.2.13
>= 10.2.14, < 10.2.16
10.2.7
10.2.10
10.2.13
10.2.16
10.2.17
10.2.18
>= 11.1.0, < 11.1.4
>= 11.1.5, < 11.1.6
18 more version ranges
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
siemens ruggedcom_ape1808_firmware All versions
cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
Original advisory text
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.


This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 May 2026
Updated26 Oct 2026
First seen13 May 2026
Sources
CVE-2026-0256 · NVD
CVE-2026-0256 · MITRE
Track software like this
Free during beta