topic Re: I have a question CVE-2026-0256 PAN-OS in VM-Series in the Public Cloud

I have a question CVE-2026-0256 PAN-OS

JiHwanHam — Sun, 17 May 2026 07:43:28 GMT

Hello.

I have a question regarding this vulnerability. The vulnerability description states that a malicious authenticated administrator could save a payload via XSS. If that is the case, wouldn't the vulnerability itself be fine as long as the Permitted IP is properly configured? However, I do not quite understand why the suggested solution involves changing the service root and resolving the issue through a TP license, so I am asking this question.

To put it simply, I would like to ask if I do not need to update the OS if a Public IP is not assigned to the MGT and the Administrator ID is configured correctly.

Re: I have a question CVE-2026-0256 PAN-OS

Raido_Rattameister — Sun, 17 May 2026 18:10:38 GMT

Changing service root and applying threat prevention is under "workaround" section in case you need to open access to mgmt interface but can't upgrade PANOS.

Re: I have a question CVE-2026-0256 PAN-OS

PavelK — Tue, 19 May 2026 06:17:21 GMT

Hello @JiHwanHam

what Palo Alto is suggesting in the advisory: CVE-2026-0256 is beyond what you can achieve with permitted IP address list for management interface. If you do inbound inspection for management interface and block the Threat ID 510020 you can inspect and block attack regardless from what IP address attack comes from or who attacker is.

To exploit this vulnerability an attacker either already has credentials (which would be bigger problem) or legitimate admin exploits this vulnerability. I agree with you that if you do not have interface exposed to internet and have only internal permitted IP addresses the risk is minimized unless one of your admins from permitted IPs exploits this vulnerability. This is likely reason it has medium severity and low EPSS score.

Kind Regards

Pavel