CVE-2026-0266

LowCVSS 1.1

Published: 10/06/2026(UTC)Updated: 11/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.03%

10th percentile — higher than 10% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software allows a malicious authenticated administrator to store a JavaScript payload using the web interface.

Risk Assessment

An attacker could exploit this vulnerability to execute malicious code in the victim's browser context, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to update PAN-OS software to the latest version to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.