CVE-2026-0316— PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
Quick assessment
Affected
Palo Alto Networks Cloud NGFW
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Palo Alto Networks PAN-OS® 软件中存在一个存储型跨站脚本（XSS）漏洞，允许经过身份验证的攻击者通过 Web 界面存储或执行恶意 JavaScript 载荷。 根据我们推荐的最佳实践部署指南，若将管理访问限制为仅受信任的内部 IP 地址，则可显著降低由此问题带来的安全风险。更多详细信息请参考：https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-ac
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | All |
unaffected |
| Palo Alto Networks | PAN-OS | 12.2.0< 12.2.4 |
affected |
12.1.0< 12.1.10-h2 |
affected | ||
11.2.0< 11.2.16 |
affected | ||
11.1.0< 11.1.16-h3 |
affected | ||
| Palo Alto Networks | Prisma Access | All< 12.1.7-h8 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-0316
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS® software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by these vulnerabilities.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | - | - |
|
| Palo Alto Networks | PAN-OS | 12.2.0 ~ 12.2.4 |
cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*
|
|
| Palo Alto Networks | Prisma Access | - | - |
|
II. Public POCs for CVE-2026-0316
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0316
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-0316 (1)
Same Patch Batch · Palo Alto Networks · 2026-10-14 · 12 CVEs total
| CVE-2026-0322 | 8.5 HIGH | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface |
| CVE-2026-0321 | 6.6 MEDIUM | PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services |
| CVE-2026-0313 | 6.1 MEDIUM | Cortex XSOAR: OS Command Injection Vulnerability |
| CVE-2026-0315 | 5.9 MEDIUM | GlobalProtect App: Local Privilege Escalation Vulnerability on macOS |
| CVE-2026-0320 | 5.7 MEDIUM | PAN-OS: Authenticated Admin Command Injection Vulnerability |
| CVE-2026-0319 | 4.9 MEDIUM | PAN-OS: Improper Input Handling Vulnerability |
| CVE-2026-0318 | 4.6 MEDIUM | PAN-OS: Denial of Service (DoS) on Panorama |
| CVE-2026-0314 | 4.3 MEDIUM | GlobalProtect App: Local Denial of Service (DoS) on Windows |
| CVE-2026-0312 | 4.3 MEDIUM | Checkov by Prisma Cloud: Path Traversal Vulnerabilities |
| CVE-2026-0317 | 1.2 LOW | PAN-OS: Denial of Service Vulnerability |
| CVE-2026-0311 | 1.1 LOW | Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability |
IV. Related Vulnerabilities
Same product: Cloud NGFW
-
CVE-2026-0317
PAN-OS: Denial of Service Vulnerability -
CVE-2026-0318
PAN-OS: Denial of Service (DoS) on Panorama -
CVE-2026-0319
PAN-OS: Improper Input Handling Vulnerability -
CVE-2026-0320
PAN-OS: Authenticated Admin Command Injection Vulnerability -
CVE-2026-0321
PAN-OS: Denial of Service (DoS) Vulnerabilities in Network S
Same vendor: Palo Alto Networks
-
CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization -
CVE-2026-0311
Checkov by Prisma Cloud: Server-Side Request Forgery Vulnera -
CVE-2026-0312
Checkov by Prisma Cloud: Path Traversal Vulnerabilities -
CVE-2026-0313
Cortex XSOAR: OS Command Injection Vulnerability -
CVE-2026-0314
GlobalProtect App: Local Denial of Service (DoS) on Windows
Same weakness: CWE-79
-
CVE-2026-96870
SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-100106
FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cr -
CVE-2026-100108
Social Share Buttons <= 1.30 - Authenticated (Subscriber+) S -
CVE-2026-87111
User Registration PRO <= 6.2.9 - Unauthenticated Stored Cros -
CVE-2026-96339
WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS)
V. Comments for CVE-2026-0316
No comments yet