CVE-2026-0281 is an information disclosure vulnerability in Palo Alto Networks PAN-OS software that enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. Successful exploitation requires user interaction, specifically a legitimate user clicking a malicious link crafted by the attacker. This vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access services are not affected. The vulnerability is categorized under CWE-524 (Information Exposure Through Cache).

An attacker can obtain web session tokens from the management web interface without authentication, potentially allowing unauthorized access to sessions. However, exploitation requires user interaction (clicking a malicious link). The impact is confidentiality loss (high), with no integrity or availability impact. The risk is mitigated by restricting management interface access to trusted internal IP addresses.

No official patch or fix is currently documented. The vendor recommends minimizing risk by restricting access to the management web interface to trusted internal IP addresses as per their best practice deployment guidelines. Users should follow Palo Alto Networks' recommended access restrictions to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.