CVE-2026-0284 MEDIUM

CVE-2026-0284: PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)

Vendor Palo Alto Networks
Product PAN-OS
Weakness CWE-74
Published July 9, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:L/E:U/AU:N/R:A/V:D/RE:M/U:Amber

What the vulnerability does

01Description

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Key dates

02Disclosure timeline

July 9, 2026 CVE published
July 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-25150 Email Templates <= 1.3 - HTML Injection CVE-2024-38700 WordPress WPCS – WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution vulnerability CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability CVE-2026-5797 Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields CVE-2022-21663 Authenticated Object Injection in Multisites in WordPress