Windows CVE-2026-0228

Improper Certificate Validation (CWE-295)

2026-02-11 psirt@paloaltonetworks.com

Windows Paloalto

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 18:16 nvd

N/A

DescriptionCVE.org

An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even if the PAN-OS configuration would not normally permit them to do so.

Analysis

Technical ContextAI

Classified as CWE-295 (Improper Certificate Validation). Affects PAN-OS. An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even if the PAN-OS configuration would not normally permit them to do so.

Affected ProductsAI

Product: PAN-OS.

RemediationAI

Monitor vendor advisories for a patch.

More in Windows

View all

CVE-2019-0803 HIGH Act Now POC

7.8 Apr 09

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM Act Now POC

5.5 Aug 17

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2025-13315 CRITICAL Emergency POC

9.3 Nov 19

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b

CVE-2013-10047 CRITICAL Emergency POC

9.3 Aug 01

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL Emergency POC

9.3 Aug 05

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

CVE-2025-34101 CRITICAL Emergency POC

9.3 Jul 10

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

CVE-2025-13316 HIGH Act Now POC

8.2 Nov 19

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred

CVE-2025-34095 CRITICAL Emergency POC

9.3 Jul 10

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/

CVE-2025-11953 CRITICAL Act Now POC

9.8 Nov 03

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo

CVE-2025-24054 MEDIUM This Month POC

6.5 Mar 11

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-295 – Improper Certificate Validation

View all

CVE-2015-3152 MEDIUM POC

5.9

CVE-2026-85102 CRITICAL POC

9.8

CVE-2017-2800 CRITICAL POC

9.8

CVE-2014-1266 HIGH POC

7.4

CVE-2022-47758 CRITICAL POC

9.8

CVE-2025-68121 CRITICAL POC

10.0

CVE-2025-29331 CRITICAL POC

9.8

CVE-2025-32878 CRITICAL POC

9.8

CVE-2026-0228 vulnerability details – vuln.today

Back