# CVE-2026-0281: Palo Alto Networks PAN-OS information disclosure in management web interface

Source: https://junglewise.ai/threats/cve-2026-0281-palo-alto-networks-pan-os-information-disclosure-in-management-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-0281 · Severity: info · CVSS 2.1 · Published 2026-07-09

An information disclosure vulnerability exists in the management interface of Palo Alto Networks firewalls and Panorama management servers. If an administrator clicks on a malicious link while their management session is active, an attacker could steal their session token. This could allow the attacker to gain unauthorized access to the device management console, potentially leading to configuration changes or further network compromise.

Technologies: [Palo Alto Networks Panorama](https://junglewise.ai/threats/technologies/panorama). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0281 being exploited in the wild.

**How severe is CVE-2026-0281?** Informational severity, with a CVSS score of 2.1, published 9 July 2026.

**Which products and versions are affected?** Palo Alto Networks Panorama All versions running affected PAN-OS releases.

**Is there a fix for CVE-2026-0281?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0281 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-0281?** Check whether you run Palo Alto Networks Panorama at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-524) exists in the PAN-OS management web interface due to improper handling of sensitive information in the cache. An unauthenticated attacker with network access to the management interface can obtain web session tokens, provided they can induce a legitimate user to interact with a malicious link (User Interaction: Active). This vulnerability affects PA-Series, VM-Series, and Panorama appliances. Successful exploitation allows for session hijacking. Palo Alto Networks has released patches in versions 12.1.8, 11.2.13, and 11.1.16; users on 10.2 must upgrade to a fixed higher branch. Mitigation includes restricting management interface access to trusted internal IP addresses.

## Affected products

- Palo Alto Networks PAN-OS 12.1 < 12.1.8, 11.2 < 11.2.13, 11.1 < 11.1.16, 10.2 All versions
- Palo Alto Networks Panorama All versions running affected PAN-OS releases

## Timeline

- 2026-07-08: disclosed: Discovered internally by Palo Alto Networks research teams.
- 2026-07-08: advisory: Initial publication of the security advisory.

## References

- [https://security.paloaltonetworks.com/CVE-2026-0281](https://security.paloaltonetworks.com/CVE-2026-0281)

## Related threats

- [Palo Alto Networks PAN-OS authenticated admin command injection](https://junglewise.ai/threats/cve-2026-0320-a-command-injection-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS stored XSS in web interface](https://junglewise.ai/threats/cve-2026-0316-a-stored-cross-site-scripting-xss-vulnerability-in-palo-alto)
- [Palo Alto Networks PAN-OS buffer overflow in XML processing](https://junglewise.ai/threats/cve-2026-0310-palo-alto-networks-pan-os-buffer-overflow-in-xml-processing)
- [Palo Alto Networks PAN-OS stored XSS in web interface](https://junglewise.ai/threats/cve-2026-0308-palo-alto-networks-pan-os-stored-xss-in-web-interface)
- [Palo Alto Networks PAN-OS file deletion in management web interface](https://junglewise.ai/threats/cve-2026-0282-palo-alto-networks-pan-os-file-deletion-in-management-web)