CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
A malicious authenticated administrator can execute JavaScript payloads via the PAN-OS web interface, potentially compromising the management console.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-0316?
CVE-2026-0316 is a low-severity cross-site scripting vulnerability in Palo Alto Networks Cloud NGFW, published on 14 Oct 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.
Weakness: CWE-79
Which versions are affected by CVE-2026-0316?
How do I fix CVE-2026-0316?
No fix has been published for CVE-2026-0316 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-0316 being exploited?
There is no known exploitation of CVE-2026-0316 in the wild and no public exploit code.
Sources
Also known as GHSA-32gf-hrr5-wrxx.