Is CVE-2026-0279 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0279 being exploited in the wild.

How severe is CVE-2026-0279?

Informational severity, with a CVSS score of 5.3, published 9 July 2026.

Which products and versions are affected?

Palo Alto Networks Prisma Access 12.1 < 12.1.8, 11.2 (all versions), 10.2 (all versions).

Is there a fix for CVE-2026-0279?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-0279 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-0279?

Check whether you run Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0279: Palo Alto Networks PAN-OS XSS in GlobalProtect and Authentication Portal

Q: Is there a fix for CVE-2026-0279?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-0279 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-0279?

Check whether you run Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0279 · Severity: info · CVSS 5.3 · Published 2026-07-09

Palo Alto Networks firewalls and management systems are affected by security flaws in their authentication and VPN portals. These vulnerabilities could allow an unauthorized person to run malicious scripts in a user's browser if they visit a compromised link. This could lead to unauthorized actions being performed on behalf of the user or the theft of session information.

Technologies: Palo Alto Networks Prisma Access. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0279 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0279 being exploited in the wild.
How severe is CVE-2026-0279?: Informational severity, with a CVSS score of 5.3, published 9 July 2026.
Which products and versions are affected?: Palo Alto Networks Prisma Access 12.1 < 12.1.8, 11.2 (all versions), 10.2 (all versions).
Is there a fix for CVE-2026-0279?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0279 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-0279?: Check whether you run Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple cross-site scripting (XSS) vulnerabilities (CWE-79) exist in the User-ID Authentication Portal (Captive Portal), GlobalProtect gateway/portal, and Clientless VPN features of PAN-OS. The root cause is improper neutralization of user-supplied input during web page generation. An unauthenticated remote attacker can exploit these flaws by enticing a user to interact with a malicious link or visiting a compromised portal page, leading to the execution of arbitrary JavaScript. While the vendor rates the base severity as Low (CVSS 1.3/5.3), the risk is elevated if management interfaces are exposed to the internet. Fixed versions include PAN-OS 12.1.8, 11.2.13, and 11.1.16.

Affected products

Palo Alto Networks PAN-OS 12.1 < 12.1.8, 11.2 < 11.2.13, 11.1 < 11.1.16, 10.2 (all versions)
Palo Alto Networks Prisma Access 12.1 < 12.1.8, 11.2 (all versions), 10.2 (all versions)

Timeline

2026-07-08: disclosed: Discovered internally by Palo Alto Networks
2026-07-09: advisory

References

https://security.paloaltonetworks.com/CVE-2026-0279

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.