CVE-2026-0279: Palo Alto Networks PAN-OS Cross-Site Scripting (XSS) in Authentication Portal

Technical summary

The vulnerabilities stem from insufficient input validation and output encoding in web-facing authentication and VPN portal components of PAN-OS. An attacker can craft a malicious URL or payload that, when accessed by a user, executes arbitrary JavaScript in the context of the affected portal. The XSS flaws fall under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability affects PA-Series and VM-Series firewalls, as well as virtual and M-Series Panorama deployments. Cloud NGFW instances are not vulnerable.

Business impact

Compromise of authentication portals creates a direct path to credential harvesting or session hijacking. An attacker could redirect users to phishing pages, steal authentication tokens, or modify portal behavior to capture credentials. In networks where these portals are internet-facing or exposed to untrusted networks, the risk of automated reconnaissance and exploitation increases. Panorama compromise could allow an attacker to pivot toward management of multiple firewalls. Reputational damage is possible if users are directed to malicious content from what appears to be a legitimate corporate portal.

Affected systems

All PAN-OS deployments on PA-Series and VM-Series firewalls are affected. Panorama (both virtual appliances and M-Series hardware) are also in scope. Cloud NGFW is explicitly not affected. The vulnerability applies to any organization running vulnerable PAN-OS versions that expose the User-ID Authentication Portal, GlobalProtect gateway/portal, or Clientless VPN to potentially untrusted users.

Exploitability

Exploitability is moderate. The attack requires an unauthenticated user and user interaction (clicking a crafted link or visiting a malicious page), but no special network privileges or authentication credentials are needed. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects network accessibility, low attack complexity, no prior authentication, and required user interaction. Severity is rated Medium (6.1) because impact is limited to confidentiality and integrity of user sessions; availability is not affected.

Remediation

Apply security patches from Palo Alto Networks for your specific PAN-OS version. Check the vendor advisory for exact patch versions applicable to your deployment (PA-Series, VM-Series, or Panorama). Immediately implement network segmentation by restricting access to the User-ID Authentication Portal and management interfaces to trusted internal IP addresses only, per Palo Alto's recommended deployment guidelines. Disable or remove unnecessary portals if not in use. Monitor authentication portal access logs for suspicious activity.

Patch guidance

Contact Palo Alto Networks or consult their official security advisory for patched PAN-OS versions. Patches should be tested in a lab environment before production deployment. Schedule maintenance windows to apply updates without disrupting VPN access or management functions. For Panorama-managed environments, coordinate patches across the management server and managed firewalls. Verify patch application by confirming the updated PAN-OS version and testing portal functionality post-deployment.

Detection guidance

Monitor web server logs on affected portals for anomalous query strings, encoded payloads, or repeated attempts to inject script tags (<script>, javascript:, onerror=, etc.). Alert on unusual portal access patterns, especially from external or untrusted networks. Implement Web Application Firewall (WAF) rules to block common XSS patterns. Monitor for privilege escalation or lateral movement attempts following successful portal compromise. Use endpoint detection tools to identify compromised sessions or credential theft. Query authentication logs for failed logins or token hijacking indicators.

Why prioritize this

While the CVSS score is Medium (6.1), prioritization depends on your network architecture. If the User-ID Authentication Portal or GlobalProtect portal is internet-facing or exposed to guests or untrusted networks, prioritize patching within 30–60 days. If strictly internal and behind network access controls, risk is significantly lower but should still be remediated within your standard update cycle. Prioritization is elevated if Panorama is exposed, as it controls multiple firewalls.

Risk score, explained

The CVSS 3.1 score of 6.1 (Medium) reflects: (1) Network-accessible attack vector with low complexity, (2) no authentication required, but (3) user interaction is mandatory, and (4) impact limited to confidentiality and integrity of user sessions without affecting system availability. The score does not account for organizational risk; a portal exposed to the internet carries higher real-world risk than an internal portal protected by network segmentation.

Frequently asked questions