Executive brief
An XML injection vulnerability exists in Palo Alto Networks PAN-OS software, specifically affecting the Large Scale VPN (LSVPN) feature used to connect remote branch offices. An unauthenticated attacker could remotely inject malicious data to view sensitive information or corrupt internal VPN configuration data. This issue only affects firewalls with LSVPN satellites configured and does not impact Panorama, Cloud NGFW, or Prisma Access.
Technical details
An XML injection vulnerability (CWE-74) exists in the Large Scale VPN (LSVPN) component of Palo Alto Networks PAN-OS. The flaw is caused by improper neutralization of special elements in output used by a downstream component, allowing an unauthenticated attacker with network access to the GlobalProtect interface to inject malicious XML content. Successful exploitation can lead to unauthorized information disclosure or the corruption of internal LSVPN satellite data. This vulnerability only impacts devices where LSVPN satellites are actively configured. Palo Alto Networks has released several patched versions across the 10.2, 11.1, 11.2, and 12.1 release trains to address this issue.
Affected products
- Palo Alto Networks PAN-OS 12.1 < 12.1.4-h8, 12.1.5 through 12.1.7-h*, 11.2 < 11.2.4-h20, 11.2.5 through 11.2.7-h*, 11.2.8 through 11.2.10-h*, 11.2.11 through 11.2.12, 11.1 < 11.1.4-h35, 11.1.5 through 11.1.6-h*, 11.1.7 through 11.1.7-h*, 11.1.8 through 11.1.10-h*, 11.1.11 through 11.1.13-h*, 11.1.14 through 11.1.15, 10.2 < 10.2.7-h36, 10.2.8 through 10.2.10-h*, 10.2.11 through 10.2.13-h*, 10.2.14 through 10.2.16-h*, 10.2.17 through 10.2.18-h*
Timeline
- 2026-07-08: disclosed: Discovered internally by Palo Alto Networks
- 2026-07-08: advisory: Initial advisory published by Palo Alto Networks
- 2026-07-09: other: NVD record created