High severity7.5NVD Advisory· Published Jul 8, 2026· Updated Aug 11, 2026

CVE-2026-0288

Description

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .

Panorama is not impacted by this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

192

Paloaltonetworks/Pan OS191 versions
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*+ 190 more
- cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*range: >=10.2.0,<10.2.7
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h21:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h22:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h33:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h34:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h32:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h33:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h34:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h25:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h26:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h27:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h28:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h18:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h13:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h14:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h15:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h16:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h17:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h10:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h8:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h9:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h5:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h6:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h7:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:-:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h1:*:*:*:*:*:*
- (no CPE)
Paloaltonetworks/Terminal Services Agentllm-fuzzy

Patches

Vulnerability mechanics

References

security.paloaltonetworks.comnvdVendor Advisory
cert-portal.siemens.com/productcert/html/ssa-104023.htmlnvd

News mentions

New InfraTrust report reveals infrastructure flaws admins should patch first
BleepingComputer · Jul 22, 2026
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
The Hacker News · Jul 13, 2026
Cyber Security Newsletter and Bulletin Weekly – 16-Year-Old Linux, Ubiquiti Flaws, Accenture Breach, Android 17 Exploit +20 Stories
Cyber Security News · Jul 12, 2026
Palo Alto Networks Patches 13 Vulnerabilities
SecurityWeek · Jul 9, 2026
Palo Alto PAN-OS Vulnerability Allows Arbitrary Code Execution Through Malicious Network Traffic
Cyber Security News · Jul 9, 2026
Palo Alto PAN-OS: Ten Vulnerabilities Disclosed Together, Including High-Severity Code Execution Flaw
Vypr Intelligence · Jul 8, 2026

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000