Skip to content
VulniPulse
Sign in
Advisory severityCritical9.2Vendor: HighPalo Alto Networks

Critical [CVE-2026-0288] PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

This critical-severity Palo Alto Networks advisory covers CVE-2026-0288 affecting PAN-OS, Prisma Access.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-0288 Source published

VulniPulse record published Record updated

CVE-2026-0288
Affected products & platforms
Palo Alto NetworksPAN-OSFirewallPrisma AccessPAN-OS / Panorama
Open source advisory

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines. Panorama is not impacted by this vulnerability.

Affected products named by the advisory: Prisma Access.

Affected versions
  • PAN-OS < 12.1.8
  • PAN-OS < 11.2.13
  • PAN-OS < 11.1.16
  • PAN-OS < 10.2.7-h36
  • Prisma Access < 11.2.7-h18
  • Prisma Access < 10.2.10-h39

Official advisory · high-confidence parse· fetched 27 days ago·verify at source

Fixed versions
  • PAN-OS >= 12.1.8
  • PAN-OS >= 12.1.7-h2
  • PAN-OS >= 12.1.4-h8
  • PAN-OS >= 11.2.13
  • PAN-OS >= 11.2.10-h12
  • PAN-OS >= 11.2.7-h18
  • PAN-OS >= 11.2.4-h20
  • PAN-OS >= 11.1.16
  • PAN-OS >= 11.1.13-h9
  • PAN-OS >= 11.1.10-h30
  • PAN-OS >= 11.1.7-h8
  • PAN-OS >= 11.1.6-h35
  • PAN-OS >= 11.1.4-h35
  • PAN-OS >= 10.2.18-h8
  • PAN-OS >= 10.2.16-h9
  • PAN-OS >= 10.2.13-h23
  • PAN-OS >= 10.2.10-h39
  • PAN-OS >= 10.2.7-h36
  • Prisma Access >= 11.2.7-h18
  • Prisma Access >= 10.2.10-h39

Official advisory · high-confidence parse· fetched 27 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • VersionMinor VersionSuggested SolutionCloud NGFWNo action needed.
  • PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later.
Temporary workarounds
  • The vast majority of firewalls already follow Palo Alto Networks' and industry best practices.
  • However, if you have not already, we strongly recommend that you restrict your User-ID Terminal Server Agent connectivity to only trusted internal IP addresses according to our best practice deployment guidelines

Official advisory · high-confidence parse· fetched 27 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.