CVE-2026-0284 is an XML injection flaw (CVSS 9.9 in the record) in the Large Scale VPN feature of PAN-OS. An unauthenticated attacker with network access can inject XML, risking information disclosure or corrupted LSVPN satellite data. Upgrade to the fixed release for your branch.
What's affected
From the vendor advisory, PAN-OS is affected before these releases:
- PAN-OS 12.1: 12.1.4-h8, 12.1.7-h2 or 12.1.8 and later
- PAN-OS 11.2: 11.2.4-h20, 11.2.7-h18, 11.2.10-h12 or 11.2.13 and later
- PAN-OS 11.1: 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9 or 11.1.16 and later
- PAN-OS 10.2: 10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9 or 10.2.18-h8 and later
Panorama, Cloud NGFW and Prisma Access are not affected. Only firewalls using LSVPN with configured satellites are exposed.
The record also lists Siemens RUGGEDCOM APE1808 products and links a Siemens advisory (SSA-104023).
How to check if you're exposed
On the firewall CLI:
show system info | match sw-version
Compare the result with the fixed releases above for your branch.
Then check for LSVPN satellites. The advisory gives this CLI check:
show config running | match satellite
Any output means LSVPN is in use. In the web interface, open Network, then GlobalProtect, then Portals, and look at the Satellite tab of each portal.
What to do now
- Upgrade to the fixed release for your PAN-OS branch.
- Run the satellite check to learn whether you are exposed at all.
- The vendor lists no workaround. Threat Prevention customers get limited coverage with Threat ID 510031 (content version 9122-10145 or later), and the vulnerability protection profile must be applied to the GlobalProtect interface.
- Check Siemens RUGGEDCOM APE1808 units against the Siemens advisory.
- Review LSVPN satellite configuration for entries you do not recognise.
Plan the upgrade as you would any firewall change. Pick the fixed release that matches your current maintenance train, since the advisory lists a separate minimum for each one. Hotfix builds carry an h suffix, so a version such as 11.2.7-h13 is newer than 11.2.7 and counts as fixed once it reaches the listed number.
If the firewalls run as a high availability pair, upgrade the passive unit first, check that it takes traffic, then move to the active one. Keep a saved configuration backup before you start, and read the release notes for the target version for any behaviour changes.
If the satellite check returns nothing, LSVPN is not in use on that firewall, and the stated condition for exposure is not met. Still upgrade on your normal schedule, and consider removing unused GlobalProtect satellite configuration so it does not come back later.
If LSVPN is in use, list the satellites and check each one still connects after the upgrade. The advisory describes corruption of internal LSVPN satellite data as a risk, so compare the satellite list before and after, and look for entries that you did not create.
Why it matters
The weakness is CWE-74 (injection into output used by a downstream component). Content from a request ends up inside an XML document, and special characters are not neutralised, so the attacker can add elements of their own. The scope is changed in the vector, because corrupted satellite data affects other devices.
The vendor rates it medium, with a threat adjusted score of 4.7 and a base score of 7.8 on CVSS 4.0, and says it is not aware of exploitation. Its note on limited Threat Prevention coverage says known patterns are caught but variations may not be. The record does not mark it as KEV. Only LSVPN users are exposed, so the check above decides how fast you move.
Injection flaws are not only about databases. XML is used for configuration and data exchange in many network products, and a request value that reaches an XML document without proper escaping lets a caller change the document. The result here, according to the advisory, can be disclosure of information or corruption of satellite data.
The scope change in the vector deserves attention. A firewall that holds the LSVPN portal sends data to remote satellite devices. If the data is corrupted at the centre, the effect spreads to every device that trusts it. That is why the NVD score is 9.9, close to the maximum, while the vendor, which considers the narrower real world conditions, rates it medium.
Use the satellite check from the advisory as the deciding step. If it returns output, move this to the top of the patch queue. If it does not, you have time to follow your regular schedule, though you should still apply the fix.
Quick check
How do I know if LSVPN is in use?
Run show config running | match satellite. Any output means it is, per the vendor.
Is a signature enough?
The vendor calls the Threat Prevention coverage limited, so upgrade as well.
What is the vendor severity?
Medium, with a threat adjusted score of 4.7 and a base score of 7.8 on CVSS 4.0. NVD shows 9.9 on CVSS 3.1.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Also referenced by the CVE record:
Last reviewed: 19 October 2026.
