Search threats, CVEs… ⌘K
Back to vendor advisories
Palo Alto Networks Security AdvisoriesCVE-2026-0284

CVE-2026-0284: PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Read the vendor bulletin Get alerts for Cloud NGFW
7.8CVSS out of 10High severity
Scope

What the vendor says is affected

  • Cloud NGFW
  • PAN-OS
  • Prisma Access
  • PAN-OS 12.1
  • PAN-OS 11.2
  • PAN-OS 11.1
  • PAN-OS 10.2

Versions the vendor lists as fixed

  • Cloud NGFW All
  • PAN-OS 12.1 >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8
  • PAN-OS 11.2 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13
  • PAN-OS 11.1 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16
  • PAN-OS 10.2 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8
  • Prisma Access All
Next step

What the vendor recommends

VERSION MINOR VERSION RANGE SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN-OS 11.2 11.2.11 through 11.2.12 Upgrade to 11.2.13 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h12 or 11.2.13 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h18 or 11.2.13 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h20 or 11.2.13 or later. PAN-OS 11.1 11.1.14 through 11.1.15 Upgrade to 11.1.16 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h9 or 11.1.16 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h30 or 11.1.16 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h8 or 11.1.16 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h35 or 11.1.16 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h35 or 11.1.16 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h8 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h9 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h23 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h39 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h36 or later. All other older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access No action needed.

Review the complete instructions on the vendor's site
Timeline

When this advisory changed

  1. Published by Palo Alto Networks

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-0284View CVSS, KEV, EPSS, and threat context
Keep investigating
See every advisory from this vendor