This vulnerability involves multiple cross-site scripting issues in the User-ID Authentication Portal, GlobalProtect gateway/portal, and Clientless VPN features of Palo Alto Networks PAN-OS software on PA-Series, VM-Series firewalls, and Panorama devices. An unauthenticated attacker can exploit these flaws to inject and execute malicious JavaScript. The Cloud NGFW product is not affected. The CVSS 4.0 base score is 1.3, indicating low severity. No official remediation or patch information is provided, and no known exploits are reported in the wild. The vendor recommends restricting access to management interfaces and the User-ID Authentication Portal to trusted internal IP addresses to minimize risk.

An unauthenticated attacker can exploit these XSS vulnerabilities to execute malicious JavaScript in the context of affected PAN-OS web interfaces, potentially leading to session hijacking or other client-side attacks. However, the overall risk is low due to the limited attack vector and the recommendation to restrict access to trusted internal IP addresses. The Cloud NGFW product is not impacted.

No official patch or remediation level is provided in the available data. The vendor recommends restricting management interface and User-ID Authentication Portal access to trusted internal IP addresses following their best practice deployment guidelines. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.