← Back

CVE-2026-0256

nvd nist
Published: May 13, 2026Modified: Jul 14, 2026

JSON object

Loading...
4.4
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:AmberShow less
Source: psirt@paloaltonetworks.com (Secondary)

Description

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Affected (172)

Paloaltonetworks
1 product
Pan Os
Siemens
1 product
Ruggedcom Ape1808 Firmware
Configuration A
69 vulnerable
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Pan Os
Before 10.2.7
Pan Os
From 10.2.11 to 10.2.13
Pan Os
From 10.2.14 to 10.2.16
Pan Os
From 10.2.8 to 10.2.10
Pan Os
Version 10.2.10
Pan Os
Version 10.2.10 h10
Pan Os
Version 10.2.10 h11
Pan Os
Version 10.2.10 h12
Pan Os
Version 10.2.10 h13
Pan Os
Version 10.2.10 h14
Pan Os
Version 10.2.10 h17
Pan Os
Version 10.2.10 h18
Pan Os
Version 10.2.10 h1
Pan Os
Version 10.2.10 h21
Pan Os
Version 10.2.10 h27
Pan Os
Version 10.2.10 h2
Pan Os
Version 10.2.10 h30
Pan Os
Version 10.2.10 h31
Pan Os
Version 10.2.10 h3
Pan Os
Version 10.2.10 h4
Pan Os
Version 10.2.10 h5
Pan Os
Version 10.2.10 h6
Pan Os
Version 10.2.10 h7
Pan Os
Version 10.2.10 h8
Pan Os
Version 10.2.13
Pan Os
Version 10.2.13 h10
Pan Os
Version 10.2.13 h15
Pan Os
Version 10.2.13 h16
Pan Os
Version 10.2.13 h18
Pan Os
Version 10.2.13 h1
Pan Os
Version 10.2.13 h2
Pan Os
Version 10.2.13 h3
Pan Os
Version 10.2.13 h4
Pan Os
Version 10.2.13 h5
Pan Os
Version 10.2.13 h7
Pan Os
Version 10.2.16
Pan Os
Version 10.2.16 h1
Pan Os
Version 10.2.16 h4
Pan Os
Version 10.2.16 h6
Pan Os
Version 10.2.17
Pan Os
Version 10.2.18
Pan Os
Version 10.2.18 h1
Pan Os
Version 10.2.18 h5
Pan Os
Version 10.2.7
Pan Os
Version 10.2.7 h10
Pan Os
Version 10.2.7 h11
Pan Os
Version 10.2.7 h12
Pan Os
Version 10.2.7 h13
Pan Os
Version 10.2.7 h14
Pan Os
Version 10.2.7 h15
Pan Os
Version 10.2.7 h16
Pan Os
Version 10.2.7 h17
Pan Os
Version 10.2.7 h18
Pan Os
Version 10.2.7 h19
Pan Os
Version 10.2.7 h1
Pan Os
Version 10.2.7 h20
Pan Os
Version 10.2.7 h21
Pan Os
Version 10.2.7 h22
Pan Os
Version 10.2.7 h23
Pan Os
Version 10.2.7 h24
Pan Os
Version 10.2.7 h2
Pan Os
Version 10.2.7 h32
Pan Os
Version 10.2.7 h3
Pan Os
Version 10.2.7 h4
Pan Os
Version 10.2.7 h5
Pan Os
Version 10.2.7 h6
Pan Os
Version 10.2.7 h7
Pan Os
Version 10.2.7 h8
Pan Os
Version 10.2.7 h9
Configuration B
62 vulnerable
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Pan Os
From 11.1.0 to 11.1.4
Pan Os
From 11.1.11 to 11.1.13
Pan Os
From 11.1.5 to 11.1.6
Pan Os
From 11.1.8 to 11.1.10
Pan Os
Version 11.1.10
Pan Os
Version 11.1.10 h10
Pan Os
Version 11.1.10 h12
Pan Os
Version 11.1.10 h1
Pan Os
Version 11.1.10 h21
Pan Os
Version 11.1.10 h4
Pan Os
Version 11.1.10 h5
Pan Os
Version 11.1.10 h7
Pan Os
Version 11.1.10 h9
Pan Os
Version 11.1.13
Pan Os
Version 11.1.13 h1
Pan Os
Version 11.1.13 h2
Pan Os
Version 11.1.13 h3
Pan Os
Version 11.1.14
Pan Os
Version 11.1.4
Pan Os
Version 11.1.4 h10
Pan Os
Version 11.1.4 h11
Pan Os
Version 11.1.4 h12
Pan Os
Version 11.1.4 h13
Pan Os
Version 11.1.4 h15
Pan Os
Version 11.1.4 h16
Pan Os
Version 11.1.4 h17
Pan Os
Version 11.1.4 h18
Pan Os
Version 11.1.4 h1
Pan Os
Version 11.1.4 h25
Pan Os
Version 11.1.4 h27
Pan Os
Version 11.1.4 h2
Pan Os
Version 11.1.4 h32
Pan Os
Version 11.1.4 h3
Pan Os
Version 11.1.4 h4
Pan Os
Version 11.1.4 h5
Pan Os
Version 11.1.4 h6
Pan Os
Version 11.1.4 h7
Pan Os
Version 11.1.4 h8
Pan Os
Version 11.1.4 h9
Pan Os
Version 11.1.6
Pan Os
Version 11.1.6 h10
Pan Os
Version 11.1.6 h14
Pan Os
Version 11.1.6 h17
Pan Os
Version 11.1.6 h18
Pan Os
Version 11.1.6 h19
Pan Os
Version 11.1.6 h1
Pan Os
Version 11.1.6 h20
Pan Os
Version 11.1.6 h21
Pan Os
Version 11.1.6 h22
Pan Os
Version 11.1.6 h23
Pan Os
Version 11.1.6 h25
Pan Os
Version 11.1.6 h29
Pan Os
Version 11.1.6 h2
Pan Os
Version 11.1.6 h3
Pan Os
Version 11.1.6 h4
Pan Os
Version 11.1.6 h5
Pan Os
Version 11.1.6 h6
Pan Os
Version 11.1.6 h7
Pan Os
Version 11.1.7
Pan Os
Version 11.1.7 h1
Pan Os
Version 11.1.7 h2
Pan Os
Version 11.1.7 h4
Configuration C
35 vulnerable
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Pan Os
From 11.2.0 to 11.2.4
Pan Os
From 11.2.5 to 11.2.7
Pan Os
From 11.2.8 to 11.2.10
Pan Os
Version 11.2.10
Pan Os
Version 11.2.10 h1
Pan Os
Version 11.2.10 h2
Pan Os
Version 11.2.10 h3
Pan Os
Version 11.2.10 h4
Pan Os
Version 11.2.10 h5
Pan Os
Version 11.2.11
Pan Os
Version 11.2.4
Pan Os
Version 11.2.4 h10
Pan Os
Version 11.2.4 h11
Pan Os
Version 11.2.4 h12
Pan Os
Version 11.2.4 h14
Pan Os
Version 11.2.4 h15
Pan Os
Version 11.2.4 h1
Pan Os
Version 11.2.4 h2
Pan Os
Version 11.2.4 h3
Pan Os
Version 11.2.4 h4
Pan Os
Version 11.2.4 h5
Pan Os
Version 11.2.4 h6
Pan Os
Version 11.2.4 h7
Pan Os
Version 11.2.4 h8
Pan Os
Version 11.2.4 h9
Pan Os
Version 11.2.7
Pan Os
Version 11.2.7 h10
Pan Os
Version 11.2.7 h11
Pan Os
Version 11.2.7 h12
Pan Os
Version 11.2.7 h1
Pan Os
Version 11.2.7 h2
Pan Os
Version 11.2.7 h3
Pan Os
Version 11.2.7 h4
Pan Os
Version 11.2.7 h7
Pan Os
Version 11.2.7 h8
Configuration D
5 vulnerable
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Pan Os
From 12.1.0 to 12.1.4
Pan Os
From 12.1.5 to 12.1.7
Pan Os
Version 12.1.4
Pan Os
Version 12.1.4 h2
Pan Os
Version 12.1.4 h3
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ruggedcom Ape1808 Firmware
All versions
Running on/withPlatform Versions
Siemens
Ruggedcom Ape1808
All versions

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: psirt@paloaltonetworks.com
Vendor Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Third Party Advisory

Timeline

No history available yet.