CVE-2026-0308: Palo Alto Networks PAN-OS XSS Vulnerability

CVE-2026-0308 Overview

CVE-2026-0308 is a stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software. A malicious authenticated administrator can store or execute a JavaScript payload through the web interface. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls, and on Panorama (virtual and M-Series appliances). Cloud NGFW and Prisma® Access are not affected.

Critical Impact
An authenticated administrator with high privileges can inject persistent JavaScript into the PAN-OS management interface, executing arbitrary script in the browser context of other administrators who view the affected pages.

Affected Products

Palo Alto Networks PAN-OS on PA-Series firewalls
Palo Alto Networks PAN-OS on VM-Series firewalls
Palo Alto Networks Panorama (virtual and M-Series)

Discovery Timeline

2026-09-10 - CVE-2026-0308 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-0308

Vulnerability Analysis

The issue is a stored XSS defect in the PAN-OS web management interface. The interface fails to properly neutralize administrator-supplied input before rendering it in subsequent HTML responses. A JavaScript payload written through an authenticated administrative action is persisted server-side and later executed in the browser of any administrator who loads the affected view.

Exploitation requires an authenticated administrator account with high privileges on the target PAN-OS or Panorama instance. It also requires a second administrator to interact with the affected interface for the payload to fire. This significantly narrows the practical attack surface to insider misuse or scenarios where an administrator account has already been compromised.

Because the payload runs inside the browser context of the management UI, it can perform actions on behalf of the viewing administrator. This includes issuing management API calls, exfiltrating session data, or modifying firewall and Panorama configurations.

Root Cause

The root cause is missing or insufficient output encoding of administrator-controlled input rendered in the PAN-OS web interface. Input that should be treated as data is instead reflected into HTML in a way that permits <script> execution or DOM-based JavaScript evaluation.

Attack Vector

The attack is network-based against the management plane. The attacker must first authenticate with high administrative privileges, then submit a crafted value through a vulnerable web interface field. The payload persists in configuration or state storage and executes when another administrator views the affected element.

No verified public proof-of-concept code is available. Refer to the Palo Alto Networks CVE-2026-0308 advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-0308

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handlers stored inside PAN-OS or Panorama configuration objects such as address groups, tags, log descriptions, or custom labels.
Administrator sessions issuing management API calls that do not correlate with observed user activity in the web interface.
Configuration commits authored by an administrator account without a matching interactive login pattern.

Detection Strategies

Review PAN-OS configuration audit logs for administrator edits that introduce HTML or JavaScript syntax into free-form text fields.
Compare configuration snapshots before and after suspected activity to identify persisted payloads in stored objects.
Monitor management interface HTTP traffic for responses containing unescaped angle brackets or script content originating from user-supplied fields.

Monitoring Recommendations

Forward PAN-OS system, configuration, and admin audit logs to a centralized analytics platform for correlation.
Alert on administrator account activity outside of approved change windows, especially configuration writes followed by unusual API calls.
Track browser-side anomalies for staff who administer PAN-OS, including unexpected outbound requests from management workstations.

How to Mitigate CVE-2026-0308

Immediate Actions Required

Apply the fixed PAN-OS versions listed in the Palo Alto Networks advisory for CVE-2026-0308 as soon as they are available in your maintenance window.
Restrict management interface access to a dedicated administrative network and a small set of trusted source IPs.
Enforce multi-factor authentication for all PAN-OS and Panorama administrator accounts and rotate credentials for any account suspected of misuse.
Audit administrator role assignments and remove unnecessary superuser privileges.

Patch Information

Palo Alto Networks maintains the authoritative patch matrix on the CVE-2026-0308 security advisory. Confirm the fixed release for your specific PAN-OS train (PA-Series, VM-Series, or Panorama) and schedule upgrades accordingly. Cloud NGFW and Prisma® Access customers require no action.

Workarounds

Limit web interface access to trusted management jump hosts and block direct administrator access from general user networks.
Use separate browsers or isolated browsing profiles dedicated to PAN-OS administration to reduce cross-context exposure.
Review and sanitize existing configuration objects for stored HTML or JavaScript content before upgrading, and remove any suspicious entries.

bash

# Restrict PAN-OS management access to a specific subnet
set deviceconfig system permitted-ip 10.10.20.0/24
commit