A stored cross‑site scripting vulnerability exists in the web interface of Palo Alto Networks PAN‑OS, allowing an authenticated administrator to save or execute JavaScript payloads. The capability could lead to session hijacking, credential theft, or web page defacement for users who log in to the management interface. The bug is mitigated by restricting the management interface to trusted internal IP addresses as recommended by Palo Alto.

The vulnerability affects PAN‑OS software running on PA‑Series and VM‑Series firewalls and on Panorama appliances. The following fixed releases are available: PAN‑OS 12.2.4 or later, 12.1.10‑h2 or later, 11.2.16 or later, 11.1.16‑h3 or later; older releases are unsupported. Cloud NGFW and Prisma Access are not affected by this vulnerability, and no workaround is available.

The CVSS score of 0.4 indicates a low impact; EPSS data is not provided and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. The flaw requires authentication as an administrator, which limits the attack surface to users with privileged access. The risk is further reduced when the management interface is limited to trusted internal networks. No known workaround exists, so mitigation relies on applying the update or restricting management access.