---
id: CVE-2026-0288
title: 'PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent'
summary: >-
  Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent
  (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated
  attacker with network access to cause a denial of service (DoS) condition or
  pot…
severity: high
cvss: 7.2
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Red
cvssSource: cna
cwe:
  - CWE-787
vendor: Palo Alto Networks
product: Cloud NGFW
affected:
  - cloud_ngfw (all versions)
  - PAN-OS >= 12.1.0 < 12.1.8
  - PAN-OS >= 11.2.0 < 11.2.13
  - PAN-OS >= 11.1.0 < 11.1.16
  - PAN-OS >= 10.2.0 < 10.2.7-h36
  - prisma_access >= 11.2.0 < 11.2.7-h18
  - prisma_access >= 10.2.0 < 10.2.10-h39
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-09T03:55:51.922548Z'
published: '2026-07-08'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:11:53.783Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-0288'
references:
  - url: 'https://security.paloaltonetworks.com/'
    label: 'https://security.paloaltonetworks.com/CVE-2026-PAN-323400'
tags:
  - cve.org
epss: 0.00832
epssPercentile: 0.56701
ingestedAt: '2026-10-15T05:52:46.051Z'
---

## Overview

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .

Panorama is not impacted by this vulnerability.

## Affected

- `cloud_ngfw (all versions)`
- `PAN-OS >= 12.1.0 < 12.1.8`
- `PAN-OS >= 11.2.0 < 11.2.13`
- `PAN-OS >= 11.1.0 < 11.1.16`
- `PAN-OS >= 10.2.0 < 10.2.7-h36`
- `prisma_access >= 11.2.0 < 11.2.7-h18`
- `prisma_access >= 10.2.0 < 10.2.10-h39`

## Remediation

Version
Minor Version
Suggested Solution
Cloud NGFWNo action needed.
                                PAN-OS 12.1

                                12.1.5 through 12.1.7-h*
                                Upgrade to 12.1.7-h2 or 12.1.8 or later.
                            
                                
                                12.1.2 through 12.1.4-h*
                                Upgrade to 12.1.4-h8 or 12.1.8 or later.
                            
                                PAN-OS 11.2

                                11.2.0 through 11.2.12
                                Upgrade to 11.2.13 or later.
                            
                                
                                11.2.0 through 11.2.10-h*
                                Upgrade to 11.2.10-h12 or 11.2.13 or later.
                            
                                
                                11.2.0 through 11.2.7-h*
                                Upgrade to 11.2.7-h18 or 11.2.13 or later.
                            
                                
                                11.2.0 through 11.2.4-h*
                                Upgrade to 11.2.4-h20 or 11.2.13 or later.
                            
                                PAN-OS 11.1

                                11.1.0 through 11.1.15
                                Upgrade to 11.1.16 or later.
                            
                                
                                11.1.0 through 11.1.13-h*
                                Upgrade to 11.1.13-h9 or 11.1.16 or later.
                            
                                
                                11.1.0 through 11.1.10-h*
                                Upgrade to 11.1.10-h30 or 11.1.16 or later.
                            
                                
                                11.1.0 through 11.1.7-h*
                                Upgrade to 11.1.7-h8 or 11.1.16 or later.
                            
                                
                                11.1.0 through 11.1.6-h*
                                Upgrade to 11.1.6-h35 or 11.1.16 or later.
                            
                                
                                11.1.0 through 11.1.4-h*
                                Upgrade to 11.1.4-h35 or 11.1.16 or later.
                            
                                PAN-OS 10.2

                                10.2.0 through 10.2.18-h*
                                Upgrade to 10.2.18-h8 or later.
                             10.2.0 through 10.2.16-h*Upgrade to 10.2.16-h9 or later.
                                
                                10.2.0 through 10.2.13-h*
                                Upgrade to 10.2.13-h23 or later.

                            
                                
                                10.2.0 through 10.2.10-h*
                                Upgrade to 10.2.10-h39 or later.

                            
                                
                                10.2.0 through 10.2.7-h*
                                Upgrade to 10.2.7-h36 or later.

                            All older
unsupported
PAN-OS versions Upgrade to a supported fixed version.
                                Prisma Access 11.2

                                11.2.0 through 11.2.7
                                Upgrade to 11.2.7-h18 or later.*
                            
                                Prisma Access 10.2

                                10.2.0 through 10.2.10
                                Upgrade to 10.2.10-h39 or later.*

                            
* See the note under Product Status for information regarding Prisma Access upgrades.

### Workarounds

The vast majority of firewalls already follow Palo Alto Networks' and industry best practices. However, if you have not already, we strongly recommend that you restrict your User-ID Terminal Server Agent connectivity to only trusted internal IP addresses according to our  best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only.