{"id":"CVE-2026-0288","title":"PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent","summary":"Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or pot…","severity":"high","cvss":7.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Red","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Palo Alto Networks","product":"Cloud NGFW","affected":["cloud_ngfw (all versions)","PAN-OS >= 12.1.0 < 12.1.8","PAN-OS >= 11.2.0 < 11.2.13","PAN-OS >= 11.1.0 < 11.1.16","PAN-OS >= 10.2.0 < 10.2.7-h36","prisma_access >= 11.2.0 < 11.2.7-h18","prisma_access >= 10.2.0 < 10.2.10-h39"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-09T03:55:51.922548Z"},"published":"2026-07-08","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:11:53.783Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-0288","references":[{"url":"https://security.paloaltonetworks.com/","label":"https://security.paloaltonetworks.com/CVE-2026-PAN-323400"}],"tags":["cve.org"],"epss":0.00832,"epssPercentile":0.56701,"ingestedAt":"2026-10-15T05:52:46.051Z","slug":"CVE-2026-0288","body":"## Overview\n\nMultiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.\n\nThe security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .\n\nPanorama is not impacted by this vulnerability.\n\n## Affected\n\n- `cloud_ngfw (all versions)`\n- `PAN-OS >= 12.1.0 < 12.1.8`\n- `PAN-OS >= 11.2.0 < 11.2.13`\n- `PAN-OS >= 11.1.0 < 11.1.16`\n- `PAN-OS >= 10.2.0 < 10.2.7-h36`\n- `prisma_access >= 11.2.0 < 11.2.7-h18`\n- `prisma_access >= 10.2.0 < 10.2.10-h39`\n\n## Remediation\n\nVersion\nMinor Version\nSuggested Solution\nCloud NGFWNo action needed.\n                                PAN-OS 12.1\n\n                                12.1.5 through 12.1.7-h*\n                                Upgrade to 12.1.7-h2 or 12.1.8 or later.\n                            \n                                \n                                12.1.2 through 12.1.4-h*\n                                Upgrade to 12.1.4-h8 or 12.1.8 or later.\n                            \n                                PAN-OS 11.2\n\n                                11.2.0 through 11.2.12\n                                Upgrade to 11.2.13 or later.\n                            \n                                \n                                11.2.0 through 11.2.10-h*\n                                Upgrade to 11.2.10-h12 or 11.2.13 or later.\n                            \n                                \n                                11.2.0 through 11.2.7-h*\n                                Upgrade to 11.2.7-h18 or 11.2.13 or later.\n                            \n                                \n                                11.2.0 through 11.2.4-h*\n                                Upgrade to 11.2.4-h20 or 11.2.13 or later.\n                            \n                                PAN-OS 11.1\n\n                                11.1.0 through 11.1.15\n                                Upgrade to 11.1.16 or later.\n                            \n                                \n                                11.1.0 through 11.1.13-h*\n                                Upgrade to 11.1.13-h9 or 11.1.16 or later.\n                            \n                                \n                                11.1.0 through 11.1.10-h*\n                                Upgrade to 11.1.10-h30 or 11.1.16 or later.\n                            \n                                \n                                11.1.0 through 11.1.7-h*\n                                Upgrade to 11.1.7-h8 or 11.1.16 or later.\n                            \n                                \n                                11.1.0 through 11.1.6-h*\n                                Upgrade to 11.1.6-h35 or 11.1.16 or later.\n                            \n                                \n                                11.1.0 through 11.1.4-h*\n                                Upgrade to 11.1.4-h35 or 11.1.16 or later.\n                            \n                                PAN-OS 10.2\n\n                                10.2.0 through 10.2.18-h*\n                                Upgrade to 10.2.18-h8 or later.\n                             10.2.0 through 10.2.16-h*Upgrade to 10.2.16-h9 or later.\n                                \n                                10.2.0 through 10.2.13-h*\n                                Upgrade to 10.2.13-h23 or later.\n\n                            \n                                \n                                10.2.0 through 10.2.10-h*\n                                Upgrade to 10.2.10-h39 or later.\n\n                            \n                                \n                                10.2.0 through 10.2.7-h*\n                                Upgrade to 10.2.7-h36 or later.\n\n                            All older\nunsupported\nPAN-OS versions Upgrade to a supported fixed version.\n                                Prisma Access 11.2\n\n                                11.2.0 through 11.2.7\n                                Upgrade to 11.2.7-h18 or later.*\n                            \n                                Prisma Access 10.2\n\n                                10.2.0 through 10.2.10\n                                Upgrade to 10.2.10-h39 or later.*\n\n                            \n* See the note under Product Status for information regarding Prisma Access upgrades.\n\n### Workarounds\n\nThe vast majority of firewalls already follow Palo Alto Networks' and industry best practices. However, if you have not already, we strongly recommend that you restrict your User-ID Terminal Server Agent connectivity to only trusted internal IP addresses according to our  best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}