EUVD-2026-42388
GHSA-rgmm-652r-crf4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red
Network-reachable and unauthenticated (AV:N/PR:N), but AT:P conditions and unproven exploitation justify AC:H; memory corruption can yield full compromise so C/I/A:H.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. .
Panorama is not impacted by this vulnerability.
AnalysisAI
Memory corruption in the User-ID Terminal Server Agent (TSA) of Palo Alto Networks PAN-OS lets an unauthenticated network attacker crash the service (DoS) or potentially execute arbitrary code by sending crafted traffic to the TSA listener. Multiple out-of-bounds write bugs are involved; the vendor's CVSS 4.0 vector flags the exploit as unproven (E:U), and no public exploit has been identified at time of analysis. Panorama is explicitly not affected, and exposure hinges on whether the optional TSA component is deployed and reachable.
Technical ContextAI
The flaw sits in the User-ID Terminal Server Agent, an optional PAN-OS feature that maps individual users to shared source IPs on multi-user Windows Terminal Server / Citrix hosts so the firewall can enforce user-based policy. TSA runs a network service that the firewall connects to; malformed traffic to this service triggers the bug. The root cause is CWE-787 (Out-of-bounds Write) - the agent writes past the bounds of a buffer while parsing attacker-controlled network input, corrupting adjacent memory. Such corruption reliably yields a crash (DoS) and, depending on heap/stack layout and exploit mitigations, may be steered into arbitrary code execution, consistent with the RCE/Buffer Overflow/Memory Corruption tags.
RemediationAI
Apply the fixed PAN-OS / TS Agent release identified in the Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0288 (the exact patched version is not present in the provided data and should be confirmed from that advisory before scheduling). As the primary compensating control until patched, follow the vendor best-practice guidance and restrict TSA connectivity to trusted internal IP addresses only (https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents) - enforce this so only the specific interfaces that legitimately connect to TSA can reach its listening port, which sharply reduces the unauthenticated attack surface with minimal functional side effects. Where TSA is not required, disabling or uninstalling the Terminal Server Agent eliminates exposure entirely at the cost of losing per-user identity mapping on shared Terminal Server hosts. Panorama requires no action for this issue.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today