CVE-2026-0256: Palo Alto PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
This Palo Alto advisory covers CVE-2026-0256 in PAN-OS.
- CVE-2026-0256
Key facts
- Vendor rating
- Medium, CVSS 6.9
- CISA KEV
- Not listed (catalogue checked )
- Affected
- PAN-OS < 12.1.7; PAN-OS < 11.2.12; PAN-OS < 11.1.15 and 1 more below
- Fixed in
- PAN-OS >= 12.1.7, PAN-OS >= 12.1.4-h5, PAN-OS >= 11.2.12 and 14 more below
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
- PAN-OS < 12.1.7
- PAN-OS < 11.2.12
- PAN-OS < 11.1.15
- PAN-OS < 10.2.18-h6
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-0256
Upgrade to a fixed release named by Palo Alto:
- PAN-OS >= 12.1.7
- PAN-OS >= 12.1.4-h5
- PAN-OS >= 11.2.12
- PAN-OS >= 11.2.10-h6
- PAN-OS >= 11.2.7-h13
- PAN-OS >= 11.2.4-h17
- PAN-OS >= 11.1.15
- PAN-OS >= 11.1.13-h5
- PAN-OS >= 11.1.10-h25
- PAN-OS >= 11.1.7-h6
- PAN-OS >= 11.1.6-h32
- PAN-OS >= 11.1.4-h33
- PAN-OS >= 10.2.18-h6
- PAN-OS >= 10.2.16-h7
- PAN-OS >= 10.2.13-h21
- PAN-OS >= 10.2.10-h36
- PAN-OS >= 10.2.7-h34
Vendor guidance
- Upgrade to a fixed release: PAN-OS >= 12.1.7; PAN-OS >= 12.1.4-h5; PAN-OS >= 11.2.12; PAN-OS >= 11.2.10-h6; ….
Workarounds
- Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510020 (from Applications and Threats content version 9100-10044 and later).
- For these Threat IDs to protect against attacks for this vulnerability:
More Palo Alto Networks advisories
CVE-2026-111497Oct 26, 2026Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks ProductsCVE-2026-109618Oct 21, 2026Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo AltoCVE-2026-0317Oct 14, 2026PAN-OS: Denial of Service VulnerabilityCVE-2026-0322Oct 14, 2026PAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceCVE-2026-0319Oct 14, 2026PAN-OS: Improper Input Handling VulnerabilityCVE-2026-0316Oct 14, 2026PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
Palo Alto Networks advisories, May 2026All Palo Alto Networks advisories
Get an email when Palo Alto PAN-OS publishes the next one.
See Palo Alto PAN-OS's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Palo Alto Networks CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
