CVE-2026-0317: PAN-OS: Denial of Service Vulnerability
CVE-2026-0317
Summary
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Products covered
Cloud NGFW
PAN-OS
Prisma Access
PAN-OS 12.1
PAN-OS 11.2
PAN-OS 11.1
PAN-OS 10.2
Remediation
Version | Minor Version | Suggested Solution |
|---|---|---|
Cloud NGFW | No action needed. | |
PAN-OS 12.1 | 12.1.2 through 12.1.4 | Upgrade to 12.1.5 or later. |
PAN-OS 11.2 | 11.2.0 through 11.2.10 | Upgrade to 11.2.11 or later. |
PAN-OS 11.1 | 11.1.0 through 11.1.13 | Upgrade to 11.1.14 or later. |
PAN-OS 10.2 | 10.2.0 through 10.2.18 | Upgrade to 11.1.14, 11.2.11, 12.1.5 or later. |
All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
Prisma Access | No action needed. |
Vendor-listed fixes
Cloud NGFW All
PAN-OS 12.1 >= 12.1.5
PAN-OS 11.2 >= 11.2.11
PAN-OS 11.1 >= 11.1.14
PAN-OS 10.2 None
Prisma Access All
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.