A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 13, 2026 · NIST NVD

   Detected

   A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

2. Jul 14, 2026 · NIST NVD

   Updated

   A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Affected

• cpe paloaltonetworks/pan-osversion unspecified
• cpe paloaltonetworks/pan-os10.2.7
• cpe siemens/ruggedcom ape1808 firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-0256

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-0256

  A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and o

  nvd.nist.gov

References

• Third Party Advisory · cert-portal.siemens.com
• Vendor Advisory · security.paloaltonetworks.com