CVE-2026-0308

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Sep 10, 2026
Source updated: Oct 15, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Cloud NGFW

Vendor: Palo Alto Networks
Product: Cloud NGFW
Platforms: Unknown
Default status: unaffected

Cloud NGFW · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
All	`unaffected`	custom	Unavailable	Unavailable	None listed

PAN-OS

Vendor: Palo Alto Networks
Product: PAN-OS
Platforms: Unknown
Default status: unaffected

PAN-OS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
12.2.0	`unaffected`	custom	12.2.3	Unavailable	`12.2.3` → `unaffected`
12.1.0	`affected`	custom	12.1.10	Unavailable	`12.1.10` → `unaffected`
11.2.0	`affected`	custom	11.2.13-h2	Unavailable	`11.2.13-h2` → `unaffected`
11.1.0	`affected`	custom	11.1.16-h2	Unavailable	`11.1.16-h2` → `unaffected`

Prisma Access

Vendor: Palo Alto Networks
Product: Prisma Access
Platforms: Unknown
Default status: affected

Prisma Access · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
All	`unaffected`	custom	12.1.4-h10	Unavailable	`12.1.7-h5` → `unaffected`