IM
IronMonkey Threat Research

CVE-2026-0266 MEDIUM

Published: 2026-06-10 | Last Modified: 2026-07-23 | Status: Modified

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Additional Descriptions (1)

Una vulnerabilidad de cross-site scripting (XSS) en el software PAN-OS® de Palo Alto Networks permite a un administrador autenticado malicioso almacenar una carga útil de JavaScript utilizando la interfaz web. Este problema es aplicable al software PAN-OS en firewalls de las series PA y VM y en Panorama (virtual y serie M). Cloud NGFW y Prisma® Access no se ven afectados por esta vulnerabilidad.

CVSS Metrics

Base Score: 4.8 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionREQUIRED
ScopeCHANGED
Confidentiality ImpactLOW
Integrity ImpactLOW
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.7

Impact Score: 2.7

Base Score: 1.1 (LOW)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

Attack VectorNETWORK
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredHIGH
User InteractionPASSIVE
Vulnerability ConfidentialityNONE
Vulnerability IntegrityLOW
Vulnerability AvailabilityNONE
Subsequent ConfidentialityNONE
Subsequent IntegrityNONE
Subsequent AvailabilityNONE

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-79

Affected Products

Vendor Product Version Update Type
paloaltonetworks pan-os * <built-in method update of dict object at 0x73d04ee30f00> Operating System
paloaltonetworks pan-os * <built-in method update of dict object at 0x73d07eea4840> Operating System
paloaltonetworks pan-os * <built-in method update of dict object at 0x73d07e878b00> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

References

Notification
Message here