Palo Alto Networks Security Advisories

Executive Summary

Palo Alto Networks has disclosed multiple vulnerabilities affecting PAN-OS and related services.

Key Details

Affected Platform

Palo Alto Networks

Attack Surface

Network accessible, unauthenticated

Recommended Action

Apply vendor patch

Affected Environment

PAN-OS versions 10.2, 11.1, 11.2, and 12.1 across Palo Alto Networks hardware and virtual firewalls, Cloud NGFW, Prisma Access, Prisma Access Agent on Windows and iOS, and Cortex XDR Broker VM.

Operational Impact

The buffer overflow (CVE-2026-0288) represents the highest risk, with potential for unauthenticated remote code execution on TSA components in addition to DoS. The DoS vulnerabilities (CVE-2026-0287) could force firewalls into maintenance mode, disrupting network security enforcement. The command injection flaw (CVE-2026-0286) could allow a compromised admin account to gain root OS access. The IPv6 bypass (CVE-2026-0280) could allow unauthorised traffic to reach protected services silently. The DLP bypass on Windows (CVE-2026-0278, CVSS 5.8) and certificate validation flaw on iOS (CVE-2026-0277, CVSS 5.7) affect Prisma Access Agent deployments.

Technical Root Cause

CVE-2026-0288 (CVSS 7.2) - Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) allow an unauthenticated attacker with network access to cause a DoS condition or potentially execute arbitrary code via specially crafted network traffic.

CVE-2026-0287 (CVSS 6.6) - Multiple DoS vulnerabilities in PAN-OS network traffic processing allow an unauthenticated attacker to force the firewall into maintenance mode via repeated specially crafted traffic to a dataplane interface.

CVE-2026-0286 (CVSS 6.0) - A command injection vulnerability in the PAN-OS management plane CLI allows an authenticated administrator to execute arbitrary OS commands as root.

CVE-2026-0285 (CVSS 4.7) - An SSRF vulnerability in the PAN-OS management web interface allows an authenticated administrator to make unauthorised requests from the firewall to internal services.

CVE-2026-0284 (CVSS 4.7) - An XML injection vulnerability in LSVPN allows an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data.

CVE-2026-0283 (CVSS 4.5) - An authentication bypass in LSVPN allows an attacker with network access to bypass security restrictions and establish an unauthorised site-to-site VPN connection.

CVE-2026-0282 (CVSS 2.7) - A file deletion vulnerability in the management web interface allows an unauthenticated attacker with access to delete files from a temporary directory.

CVE-2026-0281 (CVSS 2.1) - An information disclosure vulnerability in the management web interface allows an unauthenticated attacker to obtain web session tokens if a legitimate user first clicks a malicious link.

CVE-2026-0280 (CVSS 1.7) - An IPv6 packet processing vulnerability allows an unauthenticated attacker to bypass firewall security policy enforcement, allowing otherwise blocked traffic to reach protected services.

CVE-2026-0279 (CVSS 1.3) - Multiple XSS vulnerabilities in User-ID Authentication Portal, GlobalProtect gateway/portal, and Clientless VPN allow a malicious unauthenticated user to store or execute malicious JavaScript.

Recommended Mitigation

Apply patches to the fixed versions listed below. Where possible, restrict external access to management interfaces at the network boundary and limit access to trusted hosts and networks only. Run non-administrative software as unprivileged users to reduce the impact of latent vulnerabilities.
PAN-OS 12.1: Upgrade to 12.1.4-h8, 12.1.7-h2, or 12.1.8 or later depending on current minor version.
PAN-OS 11.2: Upgrade to 11.2.4-h20, 11.2.7-h18, 11.2.10-h12, or 11.2.13 or later.
PAN-OS 11.1: Upgrade to 11.1.4-h35, 11.1.6-h35, 11.1.7-h8, 11.1.10-h30, 11.1.13-h9, or 11.1.16 or later.
PAN-OS 10.2: Upgrade to 10.2.7-h36, 10.2.10-h39, 10.2.13-h23, 10.2.16-h9, or 10.2.18-h8 or later.
Prisma Access 11.2: Upgrade to 11.2.7-h18 or later. Prisma Access 10.2: Upgrade to 10.2.10-h39 or later.
Prisma Access Agent (Windows): Upgrade to 26.2.1 or later. Prisma Access Agent (iOS): Upgrade to 26.2.1 or later.
Cortex XDR Broker VM: Upgrade to 31.0.58 or later, or enable automatic upgrades.
Cloud NGFW: No action required for most CVEs. For CVE-2026-0287, contact Palo Alto Networks support to schedule an on-demand upgrade.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore MDR for Palo Alto

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Palo Alto Networks Security Advisories: CVE-2026-0288, CVE-2026-0287, CVE-2026-0286, CVE-2026-0285, CVE-2026-0284, CVE-2026-0283, CVE-2026-0282, CVE-2026-0281, CVE-2026-0280, CVE-2026-0279, CVE-2026-0278, CVE-2026-0277, CVE-2026-0276, PAN-SA-2026-0010. All advisories available at security.paloaltonetworks.com.