This vulnerability involves multiple cross-site scripting issues in the User-ID Authentication Portal (Captive Portal), GlobalProtect gateway/portal, and Clientless VPN features of Palo Alto Networks PAN-OS software. An unauthenticated attacker can exploit these flaws to inject and execute malicious JavaScript code. The vulnerability is specific to PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). The Cloud NGFW product is not affected. The vendor recommends restricting management interface access to trusted internal IP addresses to minimize risk. No official fix or patch has been announced as of the publication date.

Successful exploitation could allow an unauthenticated attacker to execute malicious JavaScript in the context of the affected web interfaces, potentially leading to session hijacking or other client-side impacts. However, the overall risk is low, and the impact is limited by recommended network access restrictions. There are no known exploits in the wild.

No official patch or remediation has been announced. The vendor recommends restricting management interface and User-ID Authentication Portal access to trusted internal IP addresses following their best practice deployment guidelines. Organizations should apply these network access controls to reduce exposure. Monitor vendor advisories for updates on patches or fixes.