A stored cross-site scripting (XSS) vulnerability exists in Palo Alto Networks PAN-OS software, allowing a malicious authenticated administrator to store or execute JavaScript payloads via the web interface. This issue affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted. The risk is reduced when management interfaces are restricted to trusted internal IP addresses as per Palo Alto Networks' best practices. No patch information is provided, and no known exploits are reported in the wild.