widely-deployed-product-advisoryperimeter-device-exposureembedded-device-vulnerabilityproof-of-concept-release

Palo Alto PAN-OS Flaw Exposes Firewalls to Unauthenticated Code Execution

Patch & Detection Intelligence · 2 sources · Updated 4mo ago · First seen Jul 9, 2026

Palo Alto Networks disclosed and patched 13 vulnerabilities across its products, led by CVE-2026-0288, a high-severity flaw in PAN-OS that can let an unauthenticated attacker with network access trigger memory corruption through specially crafted traffic. The bug stems from multiple buffer overflows in the User-ID Terminal Server Agent (TSA) component and can lead to denial of service and potentially arbitrary code execution on affected firewalls. Palo Alto said the issue affects PAN-OS devices only when at least one TSA entry is configured, while Panorama and Cloud NGFW on AWS are not affected.

The company assigned the flaw a CVSS-B score of 9.2 for exposed deployments and said it has no evidence of active exploitation, but urged customers to patch immediately or restrict TSA access to trusted internal IP addresses as a mitigation. The broader advisory batch also addressed medium- and low-severity issues in PAN-OS and Prisma Access Agent, including vulnerabilities that could enable root command execution, unauthorized internal requests, authentication bypass, VPN interception via MitM, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 9, 2026

Jul 9, 20264mo ago
Palo Alto Networks publishes advisories for 13 product vulnerabilities
Palo Alto Networks published advisories covering 13 vulnerabilities across PAN-OS and Prisma Access Agent, including medium- and low-severity issues such as root command execution, unauthorized internal requests, authentication bypass, VPN interception, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure. The company said it was not aware of in-the-wild exploitation and urged customers to apply patches.
Palo Alto Networks Patches 13 Vulnerabilities - SecurityWeek
Jul 9, 20264mo ago
Palo Alto Networks discloses and patches CVE-2026-0288 in PAN-OS
Palo Alto Networks disclosed CVE-2026-0288, a high-severity PAN-OS vulnerability caused by multiple buffer overflows in the User-ID Terminal Server Agent component that can lead to denial of service and potentially arbitrary code execution via crafted network traffic. The company said the issue affects PAN-OS only when at least one Terminal Server Agent entry is configured, noted no known active exploitation, and urged customers to patch or restrict TSA access.
Palo Alto PAN-OS Vulnerability Allows Arbitrary Code Execution Through Malicious Network Traffic

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Buffer Overflows in Palo Alto Networks PAN-OS User-ID Terminal Server Agent (CVE-2026-0288)

Affected products

2 linked

Pan-OsPrisma Access Agent

Organizations

1 linked

Palo Alto Networks

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Security WeekNews · Jul 9, 2026

Palo Alto Networks Patches 13 Vulnerabilities - SecurityWeekOpen source ↗

Cyber Security NewsNews · Jul 9, 2026

Palo Alto PAN-OS Vulnerability Allows Arbitrary Code Execution Through Malicious Network TrafficOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News