CVE-2026-0288

Received Received - Intake

Buffer Overflow in Palo Alto PAN-OS User-ID TSA

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: Palo Alto Networks, Inc.

Description

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-0288

Affected Vendors & Products

Vendor	Product	Version / Range
palo_alto_networks	pan-os	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability involves multiple buffer overflow issues in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software. An unauthenticated attacker with network access can exploit these vulnerabilities by sending specially crafted network traffic, which may cause a denial of service (DoS) condition or potentially allow the attacker to execute arbitrary code on the affected system.

The risk is reduced if the TSA connectivity is restricted to trusted internal IP addresses, following Palo Alto Networks' recommended best practice deployment guidelines.

Impact Analysis

Exploitation of this vulnerability can lead to a denial of service (DoS) condition, disrupting normal operations of the affected system.

More severely, it may allow an attacker to execute arbitrary code remotely without authentication, potentially leading to full system compromise.

However, the impact is minimized if the User-ID Terminal Server Agent connectivity is limited to trusted internal IP addresses.

Mitigation Strategies

To minimize the security risk posed by this vulnerability, restrict the User-ID Terminal Server Agent (TSA) connectivity to only trusted internal IP addresses as recommended by Palo Alto Networks best practice deployment guidelines.

Hi! I’m here to help you understand CVE-2026-0288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70