# CVE-2026-0279: Palo Alto Networks PAN-OS XSS in GlobalProtect and Authentication Portal

Source: https://junglewise.ai/threats/cve-2026-0279-palo-alto-networks-pan-os-xss-in-globalprotect-and-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-0279 · Severity: info · CVSS 5.3 · Published 2026-07-09

Palo Alto Networks firewalls and management systems are affected by security flaws in their authentication and VPN portals. These vulnerabilities could allow an unauthorized person to run malicious scripts in a user's browser if they visit a compromised link. This could lead to unauthorized actions being performed on behalf of the user or the theft of session information.

Technologies: [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0279 being exploited in the wild.

**How severe is CVE-2026-0279?** Informational severity, with a CVSS score of 5.3, published 9 July 2026.

**Which products and versions are affected?** Palo Alto Networks Prisma Access 12.1 < 12.1.8, 11.2 (all versions), 10.2 (all versions).

**Is there a fix for CVE-2026-0279?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0279 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-0279?** Check whether you run Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple cross-site scripting (XSS) vulnerabilities (CWE-79) exist in the User-ID Authentication Portal (Captive Portal), GlobalProtect gateway/portal, and Clientless VPN features of PAN-OS. The root cause is improper neutralization of user-supplied input during web page generation. An unauthenticated remote attacker can exploit these flaws by enticing a user to interact with a malicious link or visiting a compromised portal page, leading to the execution of arbitrary JavaScript. While the vendor rates the base severity as Low (CVSS 1.3/5.3), the risk is elevated if management interfaces are exposed to the internet. Fixed versions include PAN-OS 12.1.8, 11.2.13, and 11.1.16.

## Affected products

- Palo Alto Networks PAN-OS 12.1 < 12.1.8, 11.2 < 11.2.13, 11.1 < 11.1.16, 10.2 (all versions)
- Palo Alto Networks Prisma Access 12.1 < 12.1.8, 11.2 (all versions), 10.2 (all versions)

## Timeline

- 2026-07-08: disclosed: Discovered internally by Palo Alto Networks
- 2026-07-09: advisory

## References

- [https://security.paloaltonetworks.com/CVE-2026-0279](https://security.paloaltonetworks.com/CVE-2026-0279)

## Related threats

- [Palo Alto Networks PAN-OS information disclosure via dataplane interface](https://junglewise.ai/threats/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan)
- [Palo Alto Networks PAN-OS buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS privilege escalation in GlobalProtect](https://junglewise.ai/threats/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS GlobalProtect authorization bypass](https://junglewise.ai/threats/cve-2026-0325-an-authorization-bypass-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS GlobalProtect session hijacking](https://junglewise.ai/threats/cve-2026-0319-an-improper-input-handling-vulnerability-in-the-globalprotect)