CVE-2026-0288 | PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.

Published: 2026-07-08 Last update: 2026-07-09 Assigner: [email protected] Source: [email protected]
NVD Status：Awaiting Analysis，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-0288 is rated Moderate Risk (43/100): CVSS High severity, with low exploitation likelihood (EPSS 0.52%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-0288

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-07-09 — 0.52% —

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-0288

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.2 4.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network.
Attack complexity (AC:L)
Exploitation conditions are straightforward and stable.
Attack requirements (AT:P)
Additional preconditions must be present for exploitation.
Privileges required (PR:N)
No privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:H)
High confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:H)
High integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:H)
High availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:L)
Limited confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:L)
Limited integrity impact on subsequent systems.
Subsequent system availability impact (SA:L)
Limited availability impact on subsequent systems.
Exploit maturity (threat) (E:U)
Unreported: no public PoC, no reported exploitation, and no known simplification tools.
Confidentiality requirement (CR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Integrity requirement (IR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Availability requirement (AR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Modified attack vector (MAV:X)
Not defined: scoring uses the Base Attack Vector (AV).
Modified attack complexity (MAC:X)
Not defined: scoring uses the Base Attack Complexity (AC).
Modified attack requirements (MAT:X)
Not defined: scoring uses the Base Attack Requirements (AT).
Modified privileges required (MPR:X)
Not defined: scoring uses the Base Privileges Required (PR).
Modified user interaction (MUI:X)
Not defined: scoring uses the Base User Interaction (UI).
Modified vulnerable system confidentiality impact (MVC:X)
Not defined: scoring uses the Base VC metric.
Modified vulnerable system integrity impact (MVI:X)
Not defined: scoring uses the Base VI metric.
Modified vulnerable system availability impact (MVA:X)
Not defined: scoring uses the Base VA metric.
Modified subsequent system confidentiality impact (MSC:X)
Not defined: scoring uses the Base SC metric.
Modified subsequent system integrity impact (MSI:X)
Not defined: scoring uses the Base SI metric.
Modified subsequent system availability impact (MSA:X)
Not defined: scoring uses the Base SA metric.
Safety (supplemental) (S:X)
Not evaluated.
Automatable (supplemental) (AU:N)
No: attackers cannot reliably automate reconnaissance through exploitation for this issue.
Recovery (supplemental) (R:U)
User: manual user intervention is needed to recover services.
Value density (supplemental) (V:D)
Diffuse: a single exploit event controls relatively limited resources (e.g., one client).
Vulnerability response effort (supplemental) (RE:M)
Moderate effort (remote update, disable subsystem, simple upgrade with minor service impact).
Provider urgency (supplemental) (U:RED)
Red: provider rates highest urgency.
 — — [email protected]

Weakness enumeration for CVE-2026-0288

GitHub Security Advisory for CVE-2026-0288

GHSA-rgmm-652r-crf4 · Severity: high — Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of...

Affected software / configurations for CVE-2026-0288

Vendor Product Version Raw CPE
palo_alto_networks pan-os >= 12.1.0, < 12.1.8 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 12.1.7, < 12.1.7-h2 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 12.1.4, < 12.1.4-h8 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.2.0, < 11.2.13 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.2.10, < 11.2.10-h12 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.2.7, < 11.2.7-h18 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.2.4, < 11.2.4-h20 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.1.0, < 11.1.16 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.1.13, < 11.1.13-h9 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.1.10, < 11.1.10-h30 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.1.7, < 11.1.7-h8 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.1.6, < 11.1.6-h35 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 11.1.4, < 11.1.4-h35 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 10.2.18, < 10.2.18-h8 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 10.2.16, < 10.2.16-h9 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 10.2.13, < 10.2.13-h23 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 10.2.10, < 10.2.10-h39 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks pan-os >= 10.2.7, < 10.2.7-h36 cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*
palo_alto_networks prisma_access >= 11.2.7, < 11.2.7-h18 cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*
palo_alto_networks prisma_access >= 10.2.10, < 10.2.10-h39 cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*

References for CVE-2026-0288

cvelogic Threat Intelligence