CVE-2026-0284: Palo Alto Networks PAN-OS LSVPN XML Injection Vulnerability

CVE-2026-0284 PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) Vulnerability Overview Vulnerability ID: CVE-2026-0284 Vulnerability Type: XML Injection Affected Component: Large Scale VPN (LSVPN) functionality in Palo Alto Networks PAN-OS software Severity: Medium Urgency: Medium CVSS Score: 4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Attack Vector: Network Attack Complexity: Low User Interaction: None Privileges Required: None Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None Scope Changed: Unchanged Scope Confidentiality: High Scope Integrity: Low Scope Availability: Low Automatic Remediation: No Disclosure Date: 2026-07-09 Update Date: 2026-07-09 Discovery Method: Internal Impact Scope Affected Versions: - PAN-OS 12.1: = 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 - PAN-OS 11.2: >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13 - PAN-OS 11.1: >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 - PAN-OS 10.2: >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 - Prisma Access: All versions Remediation PAN-OS 12.1: - 12.1.5 through 12.1.7-h: Upgrade to 12.1.7-h2 or 12.1.8 or later - 12.1.2 through 12.1.4-h: Upgrade to 12.1.4-h8 or 12.1.8 or later PAN-OS 11.2: - 11.2.11 through 11.2.12: Upgrade to 11.2.13 or later - 11.2.8 through 11.2.10-h: Upgrade to 11.2.10-h12 or 11.2.13 or later - 11.2.5 through 11.2.7-h: Upgrade to 11.2.7-h18 or 11.2.13 or later - 11.2.0 through 11.2.4-h: Upgrade to 11.2.4-h20 or 11.2.13 or later PAN-OS 11.1: - 11.1.14 through 11.1.15: Upgrade to 11.1.16 or later - 11.1.11 through 11.1.13-h: Upgrade to 11.1.13-h9 or 11.1.16 or later - 11.1.8 through 11.1.10-h: Upgrade to 11.1.10-h30 or 11.1.16 or later - 11.1.7 through 11.1.7-h: Upgrade to 11.1.7-h8 or 11.1.16 or later - 11.1.5 through 11.1.6-h: Upgrade to 11.1.6-h35 or 11.1.16 or later - 11.1.0 through 11.1.4-h: Upgrade to 11.1.4-h35 or 11.1.16 or later PAN-OS 10.2: - 10.2.17 through 10.2.18-h: Upgrade to 10.2.18-h8 or later - 10.2.14 through 10.2.16-h: Upgrade to 10.2.16-h8 or later - 10.2.11 through 10.2.13-h: Upgrade to 10.2.13-h23 or later - 10.2.8 through 10.2.10-h: Upgrade to 10.2.10-h39 or later - 10.2.0 through 10.2.7-h: Upgrade to 10.2.7-h36 or later All other unsupported PAN-OS versions: Upgrade to a supported fixed version Prisma Access: No action required Additional Information Workarounds and Mitigations: No known workarounds exist. Customers with Threat Prevention subscriptions can obtain limited protection by enabling Threat ID 51003 (from Application and Threat Content versions 9122-10145 and later). CPEs: - cpe:2.3:a:palo_alto_networks:pan-os:12.1.7- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.6- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.5- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.4-h6- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.4-h5- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.4-h3- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.4-h2- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.4- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.3- - cpe:2.3:a:palo_alto_networks:pan-os:12.1.2- CPE Applicability: - cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 12.1.4 up to (excluding) 12.1.4-h8 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 12.1.7 up to (excluding) 12.1.7-h2 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 12.1.0 up to (excluding) 12.1.8 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.4 up to (excluding) 11.2.4-h20 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.7 up to (excluding) 11.2.7-h18 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.10 up to (excluding) 11.2.10-h12 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.2.0 up to (excluding) 11.2.13 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.4 up to (excluding) 11.1.4-h35 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.0 up to (excluding) 11.1.16 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.7 up to (excluding) 11.1.7-h8 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.10 up to (excluding) 11.1.10-h30 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.13 up to (excluding) 11.1.13-h9 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 11.1.6 up to (excluding) 11.1.6-h35 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.7 up to (excluding) 10.2.7-h36 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.10 up to (excluding) 10.2.10-h39 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.13 up to (excluding) 10.2.13-h23 - OR cpe:2.3:a:palo_alto_networks:pan-os: is vulnerable from (including) 10.2.16 up to (excluding) 10.2.16-h9 - OR cpe:2.3:a:pal

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-0284: Palo Alto Networks PAN-OS LSVPN XML Injection Vulnerability