CVE-2026-0288High· 7.2▾ TwilightMultiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or pot…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.8%
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .
Panorama is not impacted by this vulnerability.
cloud_ngfw (all versions)PAN-OS >= 12.1.0 < 12.1.8PAN-OS >= 11.2.0 < 11.2.13PAN-OS >= 11.1.0 < 11.1.16PAN-OS >= 10.2.0 < 10.2.7-h36prisma_access >= 11.2.0 < 11.2.7-h18prisma_access >= 10.2.0 < 10.2.10-h39Version Minor Version Suggested Solution Cloud NGFWNo action needed. PAN-OS 12.1
12.1.5 through 12.1.7-h*
Upgrade to 12.1.7-h2 or 12.1.8 or later.
12.1.2 through 12.1.4-h*
Upgrade to 12.1.4-h8 or 12.1.8 or later.
PAN-OS 11.2
11.2.0 through 11.2.12
Upgrade to 11.2.13 or later.
11.2.0 through 11.2.10-h*
Upgrade to 11.2.10-h12 or 11.2.13 or later.
11.2.0 through 11.2.7-h*
Upgrade to 11.2.7-h18 or 11.2.13 or later.
11.2.0 through 11.2.4-h*
Upgrade to 11.2.4-h20 or 11.2.13 or later.
PAN-OS 11.1
11.1.0 through 11.1.15
Upgrade to 11.1.16 or later.
11.1.0 through 11.1.13-h*
Upgrade to 11.1.13-h9 or 11.1.16 or later.
11.1.0 through 11.1.10-h*
Upgrade to 11.1.10-h30 or 11.1.16 or later.
11.1.0 through 11.1.7-h*
Upgrade to 11.1.7-h8 or 11.1.16 or later.
11.1.0 through 11.1.6-h*
Upgrade to 11.1.6-h35 or 11.1.16 or later.
11.1.0 through 11.1.4-h*
Upgrade to 11.1.4-h35 or 11.1.16 or later.
PAN-OS 10.2
10.2.0 through 10.2.18-h*
Upgrade to 10.2.18-h8 or later.
10.2.0 through 10.2.16-h*Upgrade to 10.2.16-h9 or later.
10.2.0 through 10.2.13-h*
Upgrade to 10.2.13-h23 or later.
10.2.0 through 10.2.10-h*
Upgrade to 10.2.10-h39 or later.
10.2.0 through 10.2.7-h*
Upgrade to 10.2.7-h36 or later.
All older
unsupported PAN-OS versions Upgrade to a supported fixed version. Prisma Access 11.2
11.2.0 through 11.2.7
Upgrade to 11.2.7-h18 or later.*
Prisma Access 10.2
10.2.0 through 10.2.10
Upgrade to 10.2.10-h39 or later.*
The vast majority of firewalls already follow Palo Alto Networks' and industry best practices. However, if you have not already, we strongly recommend that you restrict your User-ID Terminal Server Agent connectivity to only trusted internal IP addresses according to our best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0300Critical· 9.3PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
CVE-2026-0310High· 7.2A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service …
CVE-2026-0262Medium· 6.6PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing
CVE-2026-0257High· 7.8PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
CVE-2026-0256Medium· 4.4PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
CVE-2026-0265High· 7.2PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled