TI-2026-00218 Aliases CVE-2026-0279 GHSA-6cj9-cg4w-4m7x

PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

LOW 9CWE-79Published 2026-07-09 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW is not affected by this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0075 55th percentileScored 2026-11-07

Fix Fixed Cloud NGFW (Palo Alto Networks): AllPAN-OS (Palo Alto Networks): 12.1.8, 11.2.13, 11.1.16 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Palo Alto Networks	Cloud NGFW	—	All	Patch available	CNA
Palo Alto Networks	PAN-OS	12.1.0 to before 12.1.8; 11.2.0 to before 11.2.13; 11.1.0 to before 11.1.16; 10.2.0 to before 10.2.18-h8	12.1.8, 11.2.13, 11.1.16, 10.2.18-h8	Patch available	CNA
Palo Alto Networks	Prisma Access	12.1.0 to before 12.1.8; 11.2.0 and later; 10.2.0 and later	12.1.8	Patch available	CNA

Cloud NGFW VendorPalo Alto Networks Affected — Fixed in All Patch available CNA
PAN-OS VendorPalo Alto Networks Affected 12.1.0 to before 12.1.8; 11.2.0 to before 11.2.13; 11.1.0 to before 11.1.16; 10.2.0 to before 10.2.18-h8 Fixed in 12.1.8, 11.2.13, 11.1.16, 10.2.18-h8 Patch available CNA
Prisma Access VendorPalo Alto Networks Affected 12.1.0 to before 12.1.8; 11.2.0 and later; 10.2.0 and later Fixed in 12.1.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:paloaltonetworks:pan-os::::::::	10.2.0 to before 11.1.16; 11.2.0 to before 11.2.13; 12.1.0 to before 12.1.8	Vulnerable	CyberArk Software, a Palo Alto Networks Company

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* Versions 10.2.0 to before 11.1.16; 11.2.0 to before 11.2.13; 12.1.0 to before 12.1.8 Vulnerable ·CyberArk Software, a Palo Alto Networks Company

Remediation

Fix · CNA Cloud NGFW (Palo Alto Networks) Fixed in All
Fix · CNA PAN-OS (Palo Alto Networks) Fixed in 12.1.8, 11.2.13, 11.1.16, 10.2.18-h8
Fix · CNA Prisma Access (Palo Alto Networks) Fixed in 12.1.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-09
Palo Alto Networks PAN-OS 10.2.18-h8, 11.1.16 and 2 more versions
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-00225 PAN-OS: Authenticated Command Injection in CLIPriority LOW 32
- TI-2026-00222 PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)Priority LOW 27
- TI-2026-00224 PAN-OS: Server-Side Request Forgery Vulnerability in Management Web InterfacePriority LOW 22
Show all 7 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-0279
2026-10-03 Alias added: GHSA-6cj9-cg4w-4m7x

References

Advisory 1

https://security.paloaltonetworks.com/CVE-2026-0279

TI-2024-08782 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure KEVCVSS 4.0CRITICAL 9.9
TI-2024-03172 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect KEVCVSS 3.1CRITICAL 10.0
TI-2020-01936 PAN-OS: Authentication Bypass in SAML Authentication KEVCVSS 3.1CRITICAL 10.0
TI-2017-11675 Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and… KEVCVSS 3.1CRITICAL 9.8
TI-2026-00239 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal KEVCVSS 4.0CRITICAL 9.3
TI-2024-08784 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure KEVCVSS 4.0CRITICAL 9.2

See all 367 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences