Palo Alto Networks Security Advisories

Affected Environment

PAN-OS versions 10.2, 11.1, 11.2, and 12.1 across Palo Alto Networks hardware and virtual firewalls, Cloud NGFW, Prisma Access, Prisma Access Agent on Windows and iOS, and Cortex XDR Broker VM.

Threat Overview

Palo Alto Networks has disclosed multiple vulnerabilities affecting PAN-OS and related services. The advisory set covers buffer overflow flaws in the User-ID Terminal Server Agent, denial of service vulnerabilities in network traffic processing, a command injection flaw in the CLI, and lower-severity issues including SSRF, XML injection, authentication bypass, file deletion, information disclosure, IPv6 policy bypass, and cross-site scripting. Palo Alto Networks has released fixes for all affected products and has stated it is not aware of any malicious exploitation at time of publication. Prisma Browser also received its monthly Chromium security update.

Exposure Timeline

Advisories published 9 July 2026. No active exploitation confirmed. Fixes available for all affected versions. Standard remediation window of ten working days applies; organisations running affected versions should prioritise the highest-severity issues first.

Attack Surface

Network-accessible PAN-OS management interfaces, dataplane interfaces, and Large Scale VPN (LSVPN) satellite endpoints. The buffer overflow and DoS vulnerabilities are reachable by unauthenticated attackers with network access. Command injection requires authenticated administrator access. DLP bypass and certificate validation issues require local or on-path access.

Technical Root Cause

CVE-2026-0288 (CVSS 7.2) - Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) allow an unauthenticated attacker with network access to cause a DoS condition or potentially execute arbitrary code via specially crafted network traffic.

CVE-2026-0287 (CVSS 6.6) - Multiple DoS vulnerabilities in PAN-OS network traffic processing allow an unauthenticated attacker to force the firewall into maintenance mode via repeated specially crafted traffic to a dataplane interface.

CVE-2026-0286 (CVSS 6.0) - A command injection vulnerability in the PAN-OS management plane CLI allows an authenticated administrator to execute arbitrary OS commands as root.

CVE-2026-0285 (CVSS 4.7) - An SSRF vulnerability in the PAN-OS management web interface allows an authenticated administrator to make unauthorised requests from the firewall to internal services.

CVE-2026-0284 (CVSS 4.7) - An XML injection vulnerability in LSVPN allows an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data.

CVE-2026-0283 (CVSS 4.5) - An authentication bypass in LSVPN allows an attacker with network access to bypass security restrictions and establish an unauthorised site-to-site VPN connection.

CVE-2026-0282 (CVSS 2.7) - A file deletion vulnerability in the management web interface allows an unauthenticated attacker with access to delete files from a temporary directory.

CVE-2026-0281 (CVSS 2.1) - An information disclosure vulnerability in the management web interface allows an unauthenticated attacker to obtain web session tokens if a legitimate user first clicks a malicious link.

CVE-2026-0280 (CVSS 1.7) - An IPv6 packet processing vulnerability allows an unauthenticated attacker to bypass firewall security policy enforcement, allowing otherwise blocked traffic to reach protected services.

CVE-2026-0279 (CVSS 1.3) - Multiple XSS vulnerabilities in User-ID Authentication Portal, GlobalProtect gateway/portal, and Clientless VPN allow a malicious unauthenticated user to store or execute malicious JavaScript.