This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Palo Alto Networks PAN-OS software. An authenticated administrator can inject and store malicious JavaScript code through the web interface, potentially leading to XSS attacks. The issue affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. The CVSS 4.0 base score is 1.1, indicating low severity. No known exploits or patches are currently documented.

The vulnerability allows an authenticated administrator to store malicious JavaScript code in the web interface, which could be executed in the context of other administrators or users accessing the interface. Given the low CVSS score and requirement for authenticated high-privilege access, the impact is limited to scenarios involving trusted administrators. There is no indication of remote unauthenticated exploitation or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, administrators should limit access to the management interface to trusted personnel only and monitor for unusual administrative activity. Cloud NGFW and Prisma Access customers are not affected and do not require action.