CVE-2026-0256: Palo Alto PAN-OS Stored XSS Vulnerability

CVE-2026-0256 Overview

CVE-2026-0256 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Palo Alto Networks PAN-OS® software. An authenticated administrator with malicious intent can store a JavaScript payload through the web interface. The payload executes in the browser context of other administrators who view the affected page.

The vulnerability affects PAN-OS software running on PA-Series and VM-Series firewalls, as well as Panorama deployments (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted. The flaw requires high privileges and user interaction, limiting its practical exploitation scope.

Critical Impact

A malicious authenticated administrator can inject persistent JavaScript that executes in the context of other administrators accessing the PAN-OS web interface, potentially compromising session integrity.

Affected Products

• Palo Alto Networks PAN-OS on PA-Series firewalls
• Palo Alto Networks PAN-OS on VM-Series firewalls
• Palo Alto Networks Panorama (virtual and M-Series)

Discovery Timeline

• 2026-05-13 - CVE-2026-0256 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-0256

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the PAN-OS management web interface. An authenticated administrator can submit input containing a JavaScript payload that the application stores without sufficient output encoding. When another administrator subsequently loads the affected page, the browser renders and executes the attacker-controlled script.

Because the payload persists server-side, the attack surface extends beyond the initial submission. Any administrator viewing the affected resource becomes a potential victim. The impact is bounded by the authenticated administrator prerequisite, which limits exploitation to insiders or attackers who have already compromised administrative credentials.

The vector targets the web administration plane rather than the data plane. Firewall traffic processing remains unaffected, but management session integrity and configuration confidentiality can be undermined through hijacked administrative sessions.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. The PAN-OS web interface accepts administrator input through configuration fields and stores it without applying contextual output encoding when rendering the data back to users. JavaScript embedded in stored values executes in the browser when the page is later viewed.

Attack Vector

Exploitation requires an authenticated administrator account with sufficient privileges to write to the affected configuration field. The attacker submits a crafted payload containing JavaScript through the web interface. The malicious content is stored in the PAN-OS configuration database.

When a second administrator navigates to the page that renders the stored value, the browser executes the script under the origin of the PAN-OS management interface. The script can perform actions in the context of the victim administrator, including reading page content, issuing authenticated requests, and exfiltrating session tokens.

The vulnerability mechanism is described in the Palo Alto Networks Advisory.

Detection Methods for CVE-2026-0256

Indicators of Compromise

• Unexpected JavaScript, HTML tags, or event handler attributes (such as onerror, onload) stored in PAN-OS configuration fields visible through the web interface.
• Administrator audit log entries showing configuration changes from unfamiliar source IP addresses or at unusual times.
• Browser-side anomalies when administrators load PAN-OS or Panorama pages, including unexpected redirects or external network requests.

Detection Strategies

• Review PAN-OS configuration audit logs for changes to fields that accept free-form text, focusing on entries containing <script>, javascript:, or HTML event handler syntax.
• Inspect stored configuration values in Panorama and firewall management interfaces for content that does not match expected operational data.
• Correlate administrator authentication events with configuration modification events to identify accounts performing unusual write operations.

Monitoring Recommendations

• Forward PAN-OS and Panorama administrative audit logs to a centralized logging platform for retention and analysis.
• Alert on outbound HTTP requests originating from administrator workstations to unexpected destinations shortly after accessing the PAN-OS web interface.
• Monitor for new or modified administrator accounts and privilege changes that could enable payload injection.

How to Mitigate CVE-2026-0256

Immediate Actions Required

• Apply the security update referenced in the Palo Alto Networks Advisory for affected PAN-OS versions.
• Restrict access to the PAN-OS and Panorama web management interface to a dedicated management network and trusted administrative IP ranges.
• Audit administrator accounts and remove unused or excessive privileges to reduce the population of users who can inject stored payloads.

Patch Information

Palo Alto Networks has published vendor guidance at the Palo Alto Networks Advisory. Refer to the advisory for the list of fixed PAN-OS releases for PA-Series, VM-Series, and Panorama deployments. Cloud NGFW and Prisma® Access do not require action because they are not affected.

Workarounds

• Enforce multi-factor authentication for all PAN-OS and Panorama administrator accounts to limit the risk of credential compromise leading to payload injection.
• Use separate administrator accounts for configuration changes and routine review, and avoid browsing untrusted resources from the same browser session used for PAN-OS administration.
• Apply role-based access control to limit which administrators can write to configuration fields rendered in the web interface.

# Example: restrict PAN-OS management access to a permitted source network
set deviceconfig system permitted-ip 10.0.0.0/24
commit