CVE-2026-0288

PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

State: Published
Severity: 7.2 High
Published: Jul 8, 2026
Updated: Oct 15, 2026
Reserved: Nov 3, 2025

Description

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .

Panorama is not impacted by this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	7.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Red	palo_alto
4.0	5.2 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto
4.0	4.8 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
Cloud NGFWPalo Alto Networks	AllNot affected
PAN-OSPalo Alto Networks	12.1.0 to before 12.1.8Affectedfrom 12.1.8Not affectedfrom 12.1.7-h2Not affectedfrom 12.1.4-h8Not affected 11.2.0 to before 11.2.13Affectedfrom 11.2.13Not affectedfrom 11.2.10-h12Not affectedfrom 11.2.7-h18Not affectedfrom 11.2.4-h20Not affected 11.1.0 to before 11.1.16Affectedfrom 11.1.16Not affectedfrom 11.1.13-h9Not affectedfrom 11.1.10-h30Not affectedfrom 11.1.7-h8Not affectedfrom 11.1.6-h35Not affectedfrom 11.1.4-h35Not affected 10.2.0 to before 10.2.7-h36Affectedfrom 10.2.18-h8Not affectedfrom 10.2.16-h9Not affectedfrom 10.2.13-h23Not affectedfrom 10.2.10-h39Not affectedfrom 10.2.7-h36Not affected
Prisma AccessPalo Alto Networks	11.2.0 to before 11.2.7-h18Affectedfrom 11.2.7-h18Not affected 10.2.0 to before 10.2.10-h39Affectedfrom 10.2.10-h39Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.