The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.17, 11.1.x prior to 11.1.11, or 11.2.x prior to 11.2.7. It is, therefore, affected by a vulnerability.

    A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect gateway and portal features of     Palo Alto Networks PAN-OS software enables execution of malicious JavaScript in the context of an     authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk     is phishing attacks that can lead to credential theftparticularly if you enabled Clientless VPN.

    There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use     this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or     gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing     and credential-stealing links that appear to be hosted on the GlobalProtect portal.



    For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to     inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in     the informational bulletin PAN-SA-2025-0005 (https://security.paloaltonetworks.com/PAN-     SA-2025-0005)https://security.paloaltonetworks.com/PAN-SA-2025-0005. There is no impact to confidentiality     for GlobalProtect users if you did not enable (or you disable) Clientless VPN.

Tenable has extracted the preceding description block directly from the PAN-OS security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Palo Alto Networks PAN-OS 10.2.x < 10.2.17 / 11.1.x < 11.1.11 / 11.2.x < 11.2.7 Vulnerability

medium Nessus Plugin ID 236406

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Sep 15, 2025, 4:09 PM Logic Changes (Added multiple fix versions from updated vendor advisories to prevent inadvertent false positives.) Plugin Feed: 202509151609
Version 1.2 May 17, 2025, 6:03 AM CVSS metrics ("Cvssv4 score" set to 5.5) Detection (updated detection logic) Plugin metadata Plugin Feed: 202505170603
Version 1.1 May 15, 2025, 5:17 AM New Plugin Feed: 202505150517