Vulnerabilities / CVE-2026-0279

CVE-2026-0279

Published 2026-07-09 · Modified

CVE-2026-0279

PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

1.3 LOW
CVSS 4.0 · CNA · paloaltonetworks.com

0.8%
chance of exploitation in the next 30 days (EPSS; higher than 54% of CVEs)

Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW is not affected by this vulnerability.

Scores

1.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:AmberCNA · paloaltonetworks.com

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD

1.2CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:AmberCNA

0.4CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:AmberCNA

Affected products

paloaltonetworks pan-os: ≥ 10.2.0, < 11.1.16; ≥ 11.2.0, < 11.2.13; ≥ 12.1.0, < 12.1.8

Weakness: CWE-79

2 references (advisories, patches, write-ups)

Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website