This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Palo Alto Networks PAN-OS software. An authenticated administrator can inject and store malicious JavaScript code through the web interface, potentially leading to XSS attacks. The issue affects physical and virtual firewall appliances (PA-Series, VM-Series) and Panorama management devices but does not impact the Cloud NGFW or Prisma Access services. The CVSS 4.0 base score is 1.1, indicating low severity. There is no vendor advisory or patch information available at this time.

An authenticated administrator could store malicious JavaScript code in the web interface, which might be executed in the context of other administrators' browsers. The impact is limited by the requirement for authenticated access and the low CVSS score. There is no indication of remote unauthenticated exploitation or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unusual administrative activity. No official fix or temporary workaround has been published by the vendor.