Panorama - CraftedSignal Threat Feed

CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

hello@craftedsignal.io — Wed, 08 Jul 2026 16:10:47 +0000

Palo Alto Networks has released an advisory concerning CVE-2026-0279, which identifies multiple low-severity cross-site scripting (XSS) vulnerabilities across various components of its PAN-OS software. These vulnerabilities specifically affect the User-ID™ Authentication Portal (also known as Captive Portal), GlobalProtect™ gateway/portal features, and Clientless VPN. An unauthenticated attacker could exploit these flaws to inject and store malicious JavaScript payloads, which would then execute in the context of a legitimate user's browser when they access the vulnerable component. The risk associated with this issue is significantly reduced by adhering to Palo Alto Networks' recommended best practices, which include restricting access to management interfaces and the User-ID Authentication Portal to only trusted internal IP addresses. Cloud NGFW products are not affected. Affected versions include PAN-OS 12.1 prior to 12.1.8, 11.2 prior to 11.2.13, 11.1 prior to 11.1.16, and all 10.2 versions, along with specific Prisma Access versions. No active exploitation has been reported.

Attack Chain

Vulnerability Identification: An unauthenticated attacker identifies a vulnerable input field or parameter within the User-ID Authentication Portal, GlobalProtect gateway/portal, or Clientless VPN of an exposed PAN-OS device.
Payload Crafting: The attacker constructs a malicious JavaScript payload designed to achieve an objective such as session hijacking, credential theft, or redirection to a malicious website.
Payload Injection: The crafted JavaScript payload is injected by the attacker into the identified vulnerable component through an unauthenticated network request.
Persistent Storage: The PAN-OS application processes and stores the malicious payload, embedding it within the user-facing content of the vulnerable component.
Victim Interaction: A legitimate user accesses the compromised PAN-OS component (e.g., logs into the User-ID Authentication Portal or uses a GlobalProtect feature).
Client-Side Execution: The injected malicious JavaScript is rendered and executed by the victim's web browser as part of the legitimate PAN-OS application interface.
Malicious Action: The executed JavaScript performs its intended action, potentially leading to unauthorized access to the victim's session, exposure of sensitive information, or further client-side attacks.

Impact

The vulnerabilities, categorized as low severity, primarily impact the confidentiality and integrity of users interacting with the affected PAN-OS portals and features. While no active exploitation has been reported, successful exploitation could lead to client-side attacks where an attacker executes malicious JavaScript within a victim's browser. This could result in session hijacking, allowing unauthorized access to the victim's user session, or credential theft if the script is designed to capture login information. The overall product confidentiality and integrity are rated as LOW, and availability is rated as NONE, indicating that the vulnerability does not directly compromise the firewall's core functions or lead to denial of service. The impact is minimized when the management interfaces and portal access are restricted to trusted internal networks, as per best practices.

Recommendation

Patch CVE-2026-0279 immediately by upgrading all affected PAN-OS devices and Prisma Access deployments to the specified fixed versions: PAN-OS 12.1.8 or later, PAN-OS 11.2.13 or later, PAN-OS 11.1.16 or later, or a supported fixed version for PAN-OS 10.2. Prisma Access 11.2 should be upgraded to 11.2.7-h18 or later, and Prisma Access 10.2 to 10.2.10-h39 or later.
Implement network access restrictions to the management interface and User-ID Authentication Portal according to Palo Alto Networks' best practice deployment guidelines, ensuring access is limited to only trusted internal IP addresses.

CVE-2026-0281 PAN-OS: Information Disclosure Vulnerability in Management Web Interface

hello@craftedsignal.io — Wed, 08 Jul 2026 16:08:54 +0000

Palo Alto Networks has disclosed CVE-2026-0281, an information disclosure vulnerability affecting the management web interface of PAN-OS software across PA-Series, VM-Series firewalls, and Panorama devices. This vulnerability allows an unauthenticated attacker with network access to the management interface to obtain web session tokens. Exploitation requires a legitimate user to first click on a malicious link provided by the attacker, making it a client-side vulnerability with user interaction. While the vulnerability has been internally discovered, Palo Alto Networks is not aware of any malicious exploitation in the wild. This issue impacts PAN-OS versions 12.1.2 through 12.1.7-h*, 11.2.0 through 11.2.12, 11.1.0 through 11.1.15-h*, and all 10.2.x versions. The risk is minimized by following best practices of restricting management interface access to trusted internal IP addresses.

Attack Chain

Attacker crafts malicious link: An unauthenticated attacker creates a specially crafted malicious URL designed to exploit CVE-2026-0281 on the target PAN-OS management interface.
Attacker delivers malicious link: The attacker sends the malicious link to a legitimate user who has administrative access to the vulnerable PAN-OS management interface, likely via a social engineering campaign such as a spearphishing email or instant message.
Legitimate user clicks link: The targeted legitimate user, believing the link to be benign, clicks on the malicious URL while their browser is authenticated to the PAN-OS management interface.
Browser requests PAN-OS interface: The user's browser makes a request to the PAN-OS management web interface, triggering the information disclosure vulnerability as a result of the malicious link's parameters or redirection.
PAN-OS discloses session token: The vulnerable PAN-OS management web interface processes the request and, due to CVE-2026-0281, inadvertently discloses the user's active web session token to the attacker's controlled infrastructure.
Attacker captures session token: The attacker's controlled server or client-side script captures the exfiltrated web session token.
Attacker authenticates to PAN-OS: The attacker uses the stolen web session token to establish an unauthorized, authenticated session with the PAN-OS management interface, bypassing the need for credentials.
Unauthorized management access: With the compromised session, the attacker gains the ability to perform administrative actions on the firewall, such as modifying configurations, exfiltrating data, or establishing persistence within the network.

Impact

The primary impact of successful exploitation of CVE-2026-0281 is the unauthorized disclosure of web session tokens, which could lead to complete compromise of the Palo Alto Networks firewall management interface. Although Palo Alto Networks is not aware of any in-the-wild exploitation, organizations that fail to patch or implement proper network segmentation for their management interfaces could face severe consequences. An attacker gaining unauthorized access could reconfigure firewall rules, disable security features, establish backdoor access, or use the firewall as a pivot point for further attacks into internal networks, leading to data breaches or service disruptions. The extent of impact depends heavily on the access controls protecting the management interface.

Recommendation

Patch CVE-2026-0281: Immediately upgrade affected PAN-OS software versions to the remediated versions as per Palo Alto Networks' advisory for CVE-2026-0281.
Restrict management interface access: Secure access to your Palo Alto Networks firewall management interfaces by restricting access to only trusted internal IP addresses, as recommended by Palo Alto Networks' best practice deployment guidelines.
Review network segmentation: Ensure robust network segmentation for management networks to prevent unauthenticated external access to firewall management interfaces.
Educate users on phishing: Reinforce user education regarding spearphishing attempts and malicious links, as user interaction is required for this vulnerability's exploitation.

CVE-2026-0282 PAN-OS: Unauthenticated File Deletion Vulnerability

hello@craftedsignal.io — Wed, 08 Jul 2026 16:06:06 +0000

Palo Alto Networks has disclosed CVE-2026-0282, a low-severity file deletion vulnerability impacting its PAN-OS software, which runs on PA-Series and VM-Series firewalls, as well as Panorama management appliances (virtual and M-Series). An unauthenticated attacker with network access to the management web interface can exploit this flaw to delete files from a temporary directory. The vulnerability was discovered internally and has no reported instances of in-the-wild exploitation. While the CVSS score is low (2.7-5.1 depending on configuration), organizations are urged to patch to prevent potential misuse, especially if management interfaces are exposed to untrusted networks. Cloud NGFW and Prisma Access products are not affected by this issue, simplifying the scope of necessary updates.

Attack Chain

An unauthenticated attacker establishes network connectivity to the management web interface of a vulnerable PAN-OS device.
The attacker sends a specially crafted request to the web interface.
The PAN-OS software processes the request, which due to improper input validation, results in arbitrary file deletion.
The system deletes a file from a temporary directory on the vulnerable device.
No immediate integrity or availability impact on the product itself is observed beyond temporary file deletion.
The objective is the deletion of temporary files, which could potentially disrupt operations or be a precursor to other attacks.

Impact

The primary impact of CVE-2026-0282 is the ability for an unauthenticated attacker to delete files within a temporary directory on affected PAN-OS devices. While the direct consequence of deleting temporary files is often minimal, such actions could potentially disrupt operations or serve as a precursor to more sophisticated attacks if combined with other vulnerabilities. Palo Alto Networks stresses that the security risk is substantially mitigated by adhering to best practice deployment guidelines, which involve restricting management interface access to only trusted internal IP addresses. There are no known instances of malicious exploitation in the wild.

Recommendation

Upgrade affected PAN-OS instances to fixed versions (12.1.8, 11.2.13, 11.1.16, or later, as per CVE-2026-0282 advisory) to remediate the vulnerability.
Implement network access controls to restrict access to the management web interface of PA-Series, VM-Series, and Panorama devices from untrusted networks, as recommended in the CVE-2026-0282 advisory.