Medium [CVE-2026-0308] PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
This medium-severity Palo Alto Networks advisory covers CVE-2026-0308 affecting PAN-OS.
Android app · Google Play
Monitor future Palo Alto Networks CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- PAN-OS < 12.1.10
- PAN-OS < 11.2.13-h2
- PAN-OS < 11.1.16-h2
Official advisory · high-confidence parse· fetched 4 hours ago·verify at source
- PAN-OS >= 12.1.10
- PAN-OS >= 11.2.13-h2
- PAN-OS >= 11.1.16-h2
Official advisory · high-confidence parse· fetched 4 hours ago·verify at source
Mitigation checklist
- VersionMinor VersionSuggested SolutionCloud NGFW No action needed.PAN-OS 12.2 No action needed.
- PAN-OS 12.1 12.1.2 through 12.1.9 Upgrade to 12.1.10 or later.
- PAN-OS 11.2 11.2.0 through 11.2.13 Upgrade to 11.2.13-h2 or later.
- PAN-OS 11.1 11.1.0 through 11.1.16 Upgrade to 11.1.16-h2 or later.
- No known workarounds exist for this issue.
- Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510040 and 510041 (from Applications and Threats content version 9145-10233 and later).
- For these Threat IDs to protect against attacks for this vulnerability:
- Please note that this Threat ID requires SSL Decryption.
Official advisory · high-confidence parse· fetched 4 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.