Palo Alto Networks Patches Critical RCE Flaw

Palo Alto Networks has addressed a critical vulnerability (CVE-2026-0288) in its PAN-OS software, allowing for arbitrary code execution through malicious network traffic. This high-severity flaw, with a CVSS score of 8.7, is part of a larger advisory detailing thirteen patched vulnerabilities in Palo Alto Networks products. The advisory includes several other medium-severity issues, such as CVE-2026-0279 through CVE-2026-0287, which could potentially lead to various security compromises. Organizations using Palo Alto Networks devices should prioritize applying these patches to mitigate the risk of exploitation. As reported by SecurityWeek and Cyber Security News.

OpenStack's Ironic component is affected by two vulnerabilities: CVE-2026-44918, a high-severity flaw that prevents the rehoming of resources to nodes with different owners, and CVE-2026-54423, a moderate-severity issue enabling arbitrary IPMI command execution via the send_raw deployment step. These vulnerabilities could allow unauthorized users to manipulate resource assignments or execute commands on managed nodes, potentially leading to system compromise or data breaches. Prompt patching of the OpenStack Ironic component is recommended.

Gstreamer, a multimedia framework, has two vulnerabilities disclosed: CVE-2026-59692, a high-severity buffer overflow in the DTLS certificate verification process within the openssl_verify_callback function, and CVE-2026-59691, a medium-severity heap out-of-bounds write in the rfbsrc/librfb component when handling 16bpp framebuffers. These flaws could be exploited to crash the application or potentially achieve code execution, impacting the security of systems processing media streams.

The TrustyAI Service Operator is impacted by two vulnerabilities, CVE-2026-15063 and CVE-2026-15044. CVE-2026-15063, rated as moderate severity, allows for a port bypass even when authentication is enabled. CVE-2026-15044, also moderate, grants unauthenticated access to AI guardrails and orchestrator APIs. These issues could expose sensitive AI model configurations and operations to unauthorized parties.

A low-severity vulnerability, CVE-2026-15041, has been identified in the 389-ds-base package. This flaw involves a non-constant-time comparison in the PBKDF2-SHA256 password verification process, which could potentially weaken the security of password hashing and verification mechanisms. While rated low, it is advisable to address this issue to maintain robust security practices.