← CVE Intelligence

CVE-2026-0284

PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) PUBLISHED

Description (CNA)

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Affected (CNA)

Vendor / productVersions
Palo Alto Networks / Cloud NGFWunaffected All
Palo Alto Networks / PAN-OSaffected 12.1.0 before 12.1.4-h8; affected 11.2.0 before 11.2.4-h20; affected 11.1.0 before 11.1.4-h35; affected 10.2.0 before 10.2.7-h36
Palo Alto Networks / Prisma Accessunaffected All

CWE

CWE-74

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

siemens-SADP

No English description supplied.