CVE-2026-0279
published 2026-07-09CVE-2026-0279: Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and…
PriorityP333medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.34%
26.6th percentile
Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload.
The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW is not affected by this vulnerability.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| palo_alto_networks | pan-os | >= 10.2.0 < 10.2.18-h8 | 10.2.18-h8 |
| palo_alto_networks | pan-os | >= 11.1.0 < 11.1.16 | 11.1.16 |
| palo_alto_networks | pan-os | >= 11.2.0 < 11.2.13 | 11.2.13 |
| palo_alto_networks | pan-os | >= 12.1.0 < 12.1.8 | 12.1.8 |
| palo_alto_networks | prisma_access | — | — |
| palo_alto_networks | prisma_access | — | — |
| palo_alto_networks | prisma_access | >= 12.1.0 < 12.1.8 | 12.1.8 |
| paloalto | cloud_ngfw | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloaltonetworks | pan-os | >= 10.2.0 < 11.1.16 | 11.1.16 |
| paloaltonetworks | pan-os | >= 11.2.0 < 11.2.13 | 11.2.13 |
| paloaltonetworks | pan-os | >= 12.1.0 < 12.1.8 | 12.1.8 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.01.3LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
vendor_paloalto·CVSS 5.3
CVE-2026-0279 CWE-79 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload.
The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).
This issue is applicable to PAN-OS software on PA-Seri
VulDB
Palo Alto Captive Portal/Clientless VPN/GlobalProtect cross site scripting (EUVD-2026-42682)
vuldb·2026-07-09·CVSS 1.3
CVE-2026-0279 [LOW] Palo Alto Captive Portal/Clientless VPN/GlobalProtect cross site scripting (EUVD-2026-42682)
A vulnerability has been found in Palo Alto Captive Portal, Clientless VPN and GlobalProtect and classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in cross site scripting.
This vulnerability is cataloged as CVE-2026-0279. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS
ghsa_unreviewed·2026-07-09
CVE-2026-0279 [LOW] CWE-79 Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS
Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload.
The security risk posed by this issue is minimized when the management interface and access to the User-ID™ Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Seri
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-09
Published