CVE-2026-0256: Palo Alto Networks PAN-OS

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Affected products

• Palo Alto Networks PAN-OS: before 10.2.7 (fixed in 10.2.7); from 10.2.8, before 10.2.10 (fixed in 10.2.10); from 10.2.11, before 10.2.13 (fixed in 10.2.13); from 10.2.14, before 10.2.16 (fixed in 10.2.16); version 10.2.7 only; version 10.2.10 only; …
• Siemens Ruggedcom APE1808 Firmware: affected versions not specified

Published 2026-05-13. Last modified 2026-07-14.