Description
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.
The risk is highest when you configure the User-ID Terminal Server Agent (TSA) IP and port access from the Internet or any untrusted network.
You can reduce the risk of exploitation by restricting User-ID Terminal Server Agent (TSA) IP and port access to only trusted internal IP addresses and preventing its exposure to the internet.
The risk of exploitation is lower for Prisma Access as it requires an authenticated user and the external network access to the User-ID Terminal Server Agent (TSA) IP and port is restricted.
Problem types
Product status
All (custom)
12.1.0 (custom) before 12.1.8
11.2.0 (custom) before 11.2.13
11.1.0 (custom) before 11.1.16
10.2.0 (custom) before 10.2.7-h36
11.2.0 (custom) before 11.2.7-h18
10.2.0 (custom) before 10.2.10-h39
Timeline
| 2026-07-08: | Initial publication |
Credits
Liang Zhu
References
security.paloaltonetworks.com/CVE-2026-0288 (https://security.paloaltonetworks.com/CVE-2026-PAN-323400)