Back to search
CVE-2026-0256
Published: May 13, 2026
Modified: May 13, 2026
PUBLISHED
Description
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
| Vendor | Product | Versions |
|---|---|---|
Palo Alto Networks | Cloud NGFW | unaffected All |
Palo Alto Networks | PAN-OS | affected 12.1.0 - < 12.1.7affected 11.2.0 - < 11.2.12affected 11.1.0 - < 11.1.15affected 10.2.0 - < 10.2.18-h6 |
Palo Alto Networks | Prisma Access | unaffected All |
Weaknesses (CWE)
References
https://security.paloaltonetworks.com/CVE-2026-0256
vendor-advisory
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now