CVE-2026-0279 Palo Alto Networks CVE debrief

Who should care

Administrators and security teams using Palo Alto Networks PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series) should review and apply mitigations. They should also verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Technical summary

Multiple cross-site scripting vulnerabilities in the User-ID Authentication Portal service, GlobalProtect gateway/portal features, and Clientless VPN of Palo Alto Networks PAN-OS software enable a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized when the management interface and access to the User-ID Authentication Portal is restricted to only trusted internal IP addresses. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Defensive priority

Apply vendor patches and restrict management interface access to trusted internal IP addresses.

Recommended defensive actions

• Apply patches for affected PAN-OS software versions
• Restrict management interface access to trusted internal IP addresses
• Monitor for suspicious activity on User-ID Authentication Portal and GlobalProtect gateway/portal features
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerabilities and affected software versions. Palo Alto Networks provides a vendor advisory for mitigation. Evidence is limited to public CVE and NVD information. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources