This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Palo Alto Networks PAN-OS software. An authenticated administrator can exploit this stored XSS flaw by injecting malicious JavaScript through the web interface, which could be executed in the context of other users' browsers. The issue affects physical and virtual PA-Series and VM-Series firewalls and Panorama management platforms but does not impact the Cloud NGFW or Prisma Access services. No vendor advisory or patch information is currently available, and the remediation level is not specified.

Successful exploitation requires authenticated administrator access to the affected PAN-OS web interface. The attacker can store malicious scripts that may execute in the context of other users, potentially leading to session hijacking or unauthorized actions within the management interface. The vulnerability does not affect Palo Alto Networks Cloud NGFW or Prisma Access. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently documented, organizations should monitor Palo Alto Networks advisories for updates. Restrict administrative access to trusted personnel and networks to reduce risk until a patch or official mitigation is available.