CVE-2026-0266: Palo Alto PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
This Palo Alto advisory covers CVE-2026-0266 in PAN-OS.
- CVE-2026-0266
Key facts
- Vendor rating
- Medium, CVSS 4.8
- CISA KEV
- Not listed (catalogue checked )
- Affected
- PAN-OS < 12.1.5; PAN-OS < 11.2.11; PAN-OS < 11.1.14
- Fixed in
- PAN-OS >= 12.1.5, PAN-OS >= 11.2.11, PAN-OS >= 11.1.14
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
- PAN-OS < 12.1.5
- PAN-OS < 11.2.11
- PAN-OS < 11.1.14
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-0266
Upgrade to a fixed release named by Palo Alto:
- PAN-OS >= 12.1.5
- PAN-OS >= 11.2.11
- PAN-OS >= 11.1.14
Vendor guidance
- VersionMinor VersionSuggested SolutionCloud NGFWNo action needed.
- PAN-OS 12.1 12.1.2 through 12.1.4 Upgrade to 12.1.5 or later.
- PAN-OS 11.2 11.2.0 through 11.2.10 Upgrade to 11.2.11 or later.
- PAN-OS 11.1 11.1.0 through 11.1.13 Upgrade to 11.1.14 or later.
Workaround status
- No known workarounds or mitigations exist for this issue.
More Palo Alto Networks advisories
CVE-2026-111497Oct 26, 2026Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks ProductsCVE-2026-109618Oct 21, 2026Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo AltoCVE-2026-0317Oct 14, 2026PAN-OS: Denial of Service VulnerabilityCVE-2026-0322Oct 14, 2026PAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceCVE-2026-0319Oct 14, 2026PAN-OS: Improper Input Handling VulnerabilityCVE-2026-0316Oct 14, 2026PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
Palo Alto Networks advisories, June 2026All Palo Alto Networks advisories
Get an email when Palo Alto PAN-OS publishes the next one.
See Palo Alto PAN-OS's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Palo Alto Networks CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
