Search threats, CVEs… ⌘K
Back to vendor advisories
Palo Alto Networks Security AdvisoriesCVE-2026-0308

CVE-2026-0308: PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Read the vendor bulletin Get alerts for Cloud NGFW
4.8CVSS out of 10Medium severity
Scope

What the vendor says is affected

  • Cloud NGFW
  • PAN-OS
  • Prisma Access
  • PAN-OS 12.2
  • PAN-OS 12.1
  • PAN-OS 11.2
  • PAN-OS 11.1

Versions the vendor lists as fixed

  • Cloud NGFW All
  • PAN-OS 12.2 All
  • PAN-OS 12.1 >= 12.1.10
  • PAN-OS 11.2 >= 11.2.13-h2
  • PAN-OS 11.1 >= 11.1.16-h2
  • Prisma Access All
Next step

What the vendor recommends

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 No action needed. PAN-OS 12.1 12.1.2 through 12.1.9 Upgrade to 12.1.10 or later. PAN-OS 11.2 11.2.0 through 11.2.13 Upgrade to 11.2.13-h2 or later. PAN-OS 11.1 11.1.0 through 11.1.16 Upgrade to 11.1.16-h2 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access No action needed.

Review the complete instructions on the vendor's site
Timeline

When this advisory changed

  1. Published by Palo Alto Networks

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-0308View CVSS, KEV, EPSS, and threat context
Keep investigating
See every advisory from this vendor