CVE-2026-0288: CWE-787 Out-of-bounds Write in Palo Alto Networks Cloud NGFW
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-0288) involves multiple buffer overflow issues (CWE-787) in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software. These flaws allow an unauthenticated remote attacker to send crafted network traffic that can trigger denial of service or possibly arbitrary code execution. The vulnerability affects the Cloud NGFW product but not Panorama. The security risk is mitigated by restricting TSA connectivity to trusted internal IP addresses as per vendor best practices. No patch or official remediation level has been disclosed as of the published date.
Potential Impact
Successful exploitation can lead to denial of service or potentially arbitrary code execution on the affected system. The vulnerability is remotely exploitable without authentication, increasing its risk. However, restricting TSA connectivity to trusted internal IP addresses reduces exposure. Panorama is not impacted.
Mitigation Recommendations
No official patch or remediation level has been announced. The vendor recommends restricting User-ID Terminal Server Agent connectivity to trusted internal IP addresses to minimize risk. Monitor the vendor advisory for updates on patches or official fixes.
CVE-2026-0288: CWE-787 Out-of-bounds Write in Palo Alto Networks Cloud NGFW
Description
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.
CVSS v4.0
Score 7.2high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-0288) involves multiple buffer overflow issues (CWE-787) in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software. These flaws allow an unauthenticated remote attacker to send crafted network traffic that can trigger denial of service or possibly arbitrary code execution. The vulnerability affects the Cloud NGFW product but not Panorama. The security risk is mitigated by restricting TSA connectivity to trusted internal IP addresses as per vendor best practices. No patch or official remediation level has been disclosed as of the published date.
Potential Impact
Successful exploitation can lead to denial of service or potentially arbitrary code execution on the affected system. The vulnerability is remotely exploitable without authentication, increasing its risk. However, restricting TSA connectivity to trusted internal IP addresses reduces exposure. Panorama is not impacted.
Mitigation Recommendations
No official patch or remediation level has been announced. The vendor recommends restricting User-ID Terminal Server Agent connectivity to trusted internal IP addresses to minimize risk. Monitor the vendor advisory for updates on patches or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- palo_alto
- Date Reserved
- 2025-11-03T20:44:46.432Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4eb690c9d9e3dbe3b6871f
Added to database: 07/08/2026, 20:44:00 UTC
Last enriched: 08/11/2026, 13:17:27 UTC
Last updated: 08/23/2026, 01:10:57 UTC
Views: 192
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.