CVE-2026-0279
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Multiple cross-site scripting vulnerabilities in the User-ID Authentication Portal (Captive Portal), GlobalProtect gateway/portal features, and Clientless VPN of Palo Alto Networks PAN-OS software allow an unauthenticated attacker to store or execute malicious JavaScript payloads.
Risk Assessment
The risk to the organization includes potential session hijacking, credential theft, or malware propagation through injected scripts in user-facing interfaces.
Recommendation
Immediately restrict access to the management interface and User-ID Authentication Portal to trusted internal IP addresses per Palo Alto Networks best practices, and apply patches when available.
Other vulnerabilities in PAN-OS
See all- CVE-2026-0258Critical
An SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a DoS condition.
- CVE-2026-0264Critical
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.
- CVE-2026-0263Critical
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
- CVE-2024-9474HighActively exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-0012CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. Affects PAN-OS 10.2, 11.0, 11.1, and 11.2. Risk can be reduced by restricting access to the management interface to trusted IPs.
- CVE-2019-1579HighActively exploited
Remote code execution vulnerability in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. An unauthenticated remote attacker can execute arbitrary code.
- CVE-2026-0287High
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a DoS condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts cause the firewall to enter maintenance mode.
- CVE-2026-0286High
A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS software allows an authenticated administrator to execute arbitrary OS commands as root. The risk is significantly minimized when CLI access is restricted to a limited group of administrators.
- CVE-2026-0285Medium
An SSRF vulnerability in Palo Alto Networks PAN-OS software allows an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The risk is minimized when the management interface is restricted to trusted internal IP addresses.
- CVE-2026-0283High
An authentication bypass vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Prisma Access are not affected.
Original NVD description (English source)
Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW is not affected by this vulnerability.