PAN-OS Admin Script Injection Flaw Threatens Firewalls, Panorama; No Active Exploitation Reported
A vulnerability in PAN-OS allows authenticated administrators to execute scripts via the web interface, though no active exploitation is known.
Key points
- The issue is tracked as CVE-2026-0316 and carries a low severity rating.
- It affects PA-Series, VM-Series firewalls and Panorama appliances.
- Cloud NGFW and Prisma Access services remain unaffected by this flaw.
A stored cross-site scripting vulnerability in Palo Alto Networks PAN-OS software permits a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The vendor has classified the security risk as low, noting that the threat is minimized when the management interface is restricted to trusted internal IP addresses.
How it unfolded
- Palo Alto Networks published an advisory for CVE-2026-0316 describing the stored XSS flaw.
- The company stated it is not aware of any malicious exploitation of this issue.
- The vendor outlined that restricting access to a jump box reduces the risk of exploitation.
Who is affected
The vulnerability applies to PAN-OS software running on PA-Series and VM-Series firewalls, as well as on Panorama virtual and M-Series appliances. According to the advisory, Cloud NGFW and Prisma Access are not affected by this vulnerability. No special configuration is required for a system to be vulnerable to this issue, meaning default deployments are at risk if the access conditions are met.
The fix
The advisory lists numerous versions of PAN-OS, including branches 12.2, 12.1, 11.2, and 11.1, with specific minor versions identified. However, the source material does not explicitly confirm that a patch or update has been released for all affected versions. Until a vendor update is provided, organisations should rely on access controls to mitigate the risk.
What analysts watch for
When investigating potential XSS incidents, teams usually examine browser console logs and network traffic for unexpected script execution. Analysts check whether untrusted input was reflected or stored in web applications without proper sanitisation. They also review server-side logs for anomalous HTTP requests originating from admin interfaces. Checking for changes in user session tokens or unexpected redirects helps identify if an attacker hijacked a session through injected code.
What to do and how to stay safe: Palo Alto Networks
- Restrict access to the management interface to trusted internal IP addresses only.
- Use a jump box as the sole system allowed to access the management interface.
- Monitor web interface logs for unusual JavaScript execution or script storage attempts.
- Ensure administrative accounts follow strong authentication and least-privilege principles.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-0316?
Palo Alto Networks rates the severity as low, with a CVSS-BT score of 1.1.
Is this vulnerability currently being exploited in the wild?
No, the vendor states it is not aware of any malicious exploitation of this issue.
Which Palo Alto products are not affected by this flaw?
Cloud NGFW and Prisma Access are not affected by this vulnerability.
