CVE-2026-0288: PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-08-11
Weakness: CWE-787

Description

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.

Affected products

Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 10.2.8 before 10.2.10; from 10.2.11 before 10.2.13; from 10.2.14 before 10.2.16; from 11.1.0 before 11.1.4; from 11.1.8 before 11.1.10 — fixed in 10.2.10, 10.2.13, 10.2.16, 10.2.7, 11.1.10, 11.1.13

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.10, 10.2.13, 10.2.16, 10.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-0288 or the next vulnerability affects your stack