This vulnerability (CVE-2026-0266) involves improper neutralization of input during web page generation (CWE-79) in Palo Alto Networks PAN-OS software. An authenticated administrator can inject and store malicious JavaScript code through the web interface on PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). The vulnerability does not affect Cloud NGFW or Prisma Access. The CVSS 4.0 base score is 1.1, indicating low severity. No known exploits or patches are currently documented.

The vulnerability could allow an authenticated administrator to execute stored cross-site scripting attacks, potentially impacting the confidentiality or integrity of the web interface session. However, the low CVSS score and requirement for authenticated administrator privileges limit the impact. There is no indication of remote unauthenticated exploitation or direct denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, organizations should monitor Palo Alto Networks advisories for updates. Restricting administrator access and following least privilege principles may reduce risk until a fix is available.