OTPulse

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

MonitorCVSS 4.8CVE-2026-0316Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

A stored XSS vulnerability in PAN-OS and Prisma Access allows an authenticated administrator to inject and execute malicious JavaScript code through the web management interface. When another administrator accesses the interface, the injected code executes in their browser session. This affects PA-Series firewalls, VM-Series virtual firewalls, Panorama (virtual and M-Series), and Prisma Access. The vulnerability requires valid administrator credentials and the ability to reach the management interface. Cloud NGFW is not affected.

What this means
What could happen
A malicious administrator could inject malicious JavaScript into the firewall's web management interface, potentially compromising other administrators' sessions or stealing their credentials when they log in.
Who's at risk
Network administrators and security personnel at utilities and water authorities who operate Palo Alto Networks PA-Series firewalls, VM-Series virtual firewalls, or Panorama management appliances. This affects organizations that rely on these firewalls for perimeter security and network segmentation.
How it could be exploited
An attacker with valid administrator credentials accesses the PAN-OS web interface and injects a stored JavaScript payload through a vulnerable input field. When another administrator logs into the same interface, the payload executes in their browser, allowing the attacker to steal session cookies, credentials, or perform actions on their behalf.
Prerequisites
  • Valid administrator credentials for the PAN-OS management interface
  • Network access to the management web interface (typically restricted to internal networks)
  • The management interface must not be externally facing or properly isolated
Requires administrator credentialsAffects authentication and authorizationLow severity but impacts integrity of management planeRisk is minimized when management interface is restricted to trusted networks
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
PAN-OSBelow 12.2.412.2.4+
Prisma AccessBelow 12.1.10-h212.1.10-h2+
Remediation & Mitigation
0/4
Do now
0/1
PAN-OS
WORKAROUNDRestrict access to the PAN-OS management interface to trusted internal IP addresses only using firewall rules or network segmentation
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later
Prisma Access
HOTFIXUpdate Prisma Access to version 12.1.10-h2 or later
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate the management interface from untrusted networks and limit administrator access to a dedicated management VLAN
View full vendor advisory
API: /api/v1/advisories/0e4812ed-cd47-4de5-a5fe-7b7460cbc134

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.