Palo Alto Networks Releases Security Update for PAN-OS

Successful exploitation of CVE-2026-0288 could result in a denial-of-service condition or lead to arbitrary code execution via specially crafted network traffic

Threat ID:: CC-4811
Threat Severity:: Medium
Published:: 9 July 2026 1:00 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-0288 could result in a denial-of-service condition or lead to arbitrary code execution via specially crafted network traffic

Affected platforms

The following platforms are known to be affected:

Palo Alto Networks PAN-OS

PAN-OS 12.1

All prior to 12.1.4-h8
All prior to 12.1.7-h2
All prior to 12.1.8

PAN-OS 11.2

All prior to 11.2.4-h20
All prior to 11.2.7-h18
All prior to 11.2.10-h12
All prior to 11.2.13

PAN-OS 11.1

All prior to 11.1.4-h35
All prior to 11.1.6-h35
All prior to 11.1.7-h8
All prior to 11.1.10-h30
All prior to 11.1.13-h9
All prior to 11.1.16

PAN-OS 10.2

All prior to 10.2.7-h36
All prior to 10.2.10-h39
All prior to 10.2.13-h23
All prior to 10.2.16-h9
All prior to 10.2.18-h8

Prisma Access 11.2.0

All prior to 11.2.7-h18

Prisma Access 10.2.0

All prior to 10.2.10-h39

Note: Cloud NGFW is not impacted by this vulnerability.

Threat details

Introduction

Palo Alto Networks has released a security advisory to address a vulnerability in the Palo Alto Networks PAN-OS software. Successful exploitation could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

CVE-2026-0288 - 'Out-of-bounds write' vulnerability - CVSSv4 score - 7.2.

Note: The risk of CVE-2026-0288 is minimised when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to Palo Alto Network's recommended best practice deployment guidelines.

Remediation advice

Affected organisations are encouraged to review the Palo Alto Networks security advisory and apply relevant patches as soon as possible.

Definitive source of threat updates

https://security.paloaltonetworks.com/CVE-2026-0288

CVE Vulnerabilities

Status Published

CVE-2026-0288

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.

Last edited: 9 July 2026 1:00 pm