Palo Alto Networks released advisories addressing 13 vulnerabilities in PAN-OS and related products. The highest severity issue, CVE-2026-0288, involves multiple buffer overflows exploitable by unauthenticated attackers with network access to cause denial of service and potentially arbitrary code execution. Risk is mitigated by restricting access to the User-ID Terminal Server Agent to trusted internal IPs. Medium-severity vulnerabilities affect PAN-OS and Prisma Access Agent, enabling denial of service, root-level command execution, SSRF, information disclosure, authentication bypass, man-in-the-middle attacks, and VPN traffic interception. Exploitation of higher-impact issues requires admin authentication. Five low-severity vulnerabilities allow privilege escalation, cross-site scripting code execution, firewall policy bypass, file deletion, and information disclosure. Palo Alto Networks is not aware of active exploitation and highlights increased internal vulnerability discovery aided by AI. Organizations are advised to install the latest patches to mitigate these risks.

The vulnerabilities collectively allow attackers to cause denial of service, execute arbitrary code or OS commands, bypass authentication, perform SSRF, intercept VPN traffic, and escalate privileges. The most critical vulnerability enables unauthenticated network attackers to disrupt firewall operations and potentially execute code. Medium-severity flaws require admin authentication but can lead to significant compromise including root command execution and unauthorized internal network requests. Low-severity issues may allow privilege escalation and information disclosure. No active exploitation is currently known, reducing immediate risk but patching is important to prevent future attacks.

Palo Alto Networks has released patches addressing all 13 vulnerabilities. Organizations should apply these official fixes promptly. Risk from the highest severity vulnerability is mitigated by restricting access to the User-ID Terminal Server Agent to trusted internal IP addresses. No indication of 'no action required' or 'already mitigated' was provided by the vendor. Patch status is confirmed by the vendor advisory. There are no known exploits in the wild, but applying the latest patches is strongly recommended to prevent potential exploitation.