This vulnerability involves improper neutralization of special elements in XML output used by the LSVPN component of Palo Alto Networks PAN-OS software. An unauthenticated attacker with network access can exploit this XML injection flaw to inject malicious XML content, potentially causing information disclosure or corruption of internal LSVPN satellite data. Other Palo Alto Networks products such as Panorama, Cloud NGFW, and Prisma Access are not impacted. No official remediation or patch has been disclosed as of the publication date.

Successful exploitation can lead to unauthorized injection of XML content, which may result in information disclosure or corruption of internal LSVPN satellite data. The vulnerability does not require authentication and can be exploited remotely over the network. However, the overall impact is rated medium severity with limited scope and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should monitor Palo Alto Networks advisories for updates. No specific mitigations are provided in the current data.