PT-2026-40753 · Palo Alto Networks · Pan-Os+3

CVE-2026-0256 · Published 2026-05-13 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions PAN-OS (affected versions not specified)

Description A stored cross-site scripting (XSS) issue in the web interface allows an authenticated administrator to store a JavaScript payload. This affects PA-Series and VM-Series firewalls, as well as Panorama (virtual and M-Series).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-07045

CVE-2026-0256

Affected Products

Pa-Series

Pan-Os

Panorama

Vm Series

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-0256 · Security Note
• https://bdu.fstec.ru/vul/2026-07045 · Security Note
• https://security.paloaltonetworks.com/CVE-2026-0256 · Vendor Advisory
• https://twitter.com/CVEnew/status/2054709282546016370 · Twitter Post
• https://reddit.com/r/paloaltonetworks/comments/1ti4crw/panos_1117h6_11110h26_11113h6_1124h17_1127h15 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2054737436777869715 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-967325.html · Note