Cross-site scripting in Palo Alto PAN-OS - CVE-2026-0316
Published: October 15, 2026
Vulnerability identifier: #VU155832
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-0316
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute JavaScript in the web interface.
The vulnerability exists due to improper neutralization of input during web page generation in the PAN-OS web interface when rendering stored content. A remote privileged user can store a JavaScript payload through the web interface to execute JavaScript in the web interface.
Exploitation requires passive user interaction. No special configuration is required for exposure.
Affected software
Palo Alto PAN-OS
How to mitigate CVE-2026-0316
Install security update from vendor's website.
Palo Alto PAN-OS - addressed in versions 11.1.16-h3, 11.2.16, 12.1.10-h2, 12.2.4