Loading story…
Palo Alto Networks disclosed and patched 13 vulnerabilities across its products, led by CVE-2026-0288, a high-severity flaw in PAN-OS that can let an unauthenticated attacker with network access trigger memory corruption through specially crafted traffic. The bug stems from multiple buffer overflows in the User-ID Terminal Server Agent (TSA) component and can lead to denial of service and potentially arbitrary code execution on affected firewalls. Palo Alto said the issue affects PAN-OS devices only when at least one TSA entry is configured, while Panorama and Cloud NGFW on AWS are not affected.
The company assigned the flaw a CVSS-B score of 9.2 for exposed deployments and said it has no evidence of active exploitation, but urged customers to patch immediately or restrict TSA access to trusted internal IP addresses as a mitigation. The broader advisory batch also addressed medium- and low-severity issues in PAN-OS and Prisma Access Agent, including vulnerabilities that could enable root command execution, unauthorized internal requests, authentication bypass, VPN interception via MitM, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks published advisories covering 13 vulnerabilities across PAN-OS and Prisma Access Agent, including medium- and low-severity issues such as root command execution, unauthorized internal requests, authentication bypass, VPN interception, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure. The company said it was not aware of in-the-wild exploitation and urged customers to apply patches.
Palo Alto Networks disclosed CVE-2026-0288, a high-severity PAN-OS vulnerability caused by multiple buffer overflows in the User-ID Terminal Server Agent component that can lead to denial of service and potentially arbitrary code execution via crafted network traffic. The company said the issue affects PAN-OS only when at least one Terminal Server Agent entry is configured, noted no known active exploitation, and urged customers to patch or restrict TSA access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks disclosed and patched **CVE-2026-0300**, a critical `PAN-OS` vulnerability in the **User-ID Authentication Portal** that can let an unauthenticated remote attacker execute arbitrary code with **root** privileges. The flaw, rated **CVSS 9.3**, is described as a stack overflow and out-of-bounds write issue affecting multiple `PAN-OS` release lines, including versions in the `10.2`, `11.1`, `11.2`, and `12.1` branches, on affected **PA Series** and **VM-Series** firewalls. Palo Alto Networks reported signs of **active exploitation**, particularly on devices exposed to the internet or reachable from untrusted IP addresses, and **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog. Exploitation depends on the Authentication Portal being enabled and a management interface profile with a response page being attached to a Layer 3 interface reachable by untrusted traffic; defenders were urged to upgrade to fixed releases, restrict portal access to trusted zones or IP addresses, disable the feature if unnecessary, and investigate systems for signs of compromise.
Jul 24, 2026
Palo Alto Networks disclosed **CVE-2026-0300**, a critical `CWE-787` buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows **unauthenticated remote code execution as root** on affected **PA-Series** and **VM-Series** firewalls. The flaw carries a **CVSS v4 score of 9.3** when the portal is exposed to untrusted networks or the public internet, and Palo Alto confirmed limited in-the-wild exploitation against exposed portals. Affected versions span PAN-OS 10.2, 11.1, 11.2, and 12.1, while **Prisma Access, Cloud NGFW, and Panorama are not affected**. With patches not immediately available at disclosure, Palo Alto said fixed releases would begin rolling out between May 13 and May 28 and urged customers to restrict portal access to trusted internal zones or disable the feature entirely; the company also released a Threat Prevention Signature for PAN-OS 11.1 and later. U.S. **CISA** added the vulnerability to its **Known Exploited Vulnerabilities** catalog and ordered federal civilian agencies to remediate by the mandated deadline, while other national and regional cyber authorities issued parallel alerts. Palo Alto Unit 42 and multiple reports linked the activity to a likely state-sponsored cluster tracked as **CL-STA-1132**, which reportedly probed targets for weeks, injected shellcode into an `nginx` worker process, deleted crash artifacts and logs, enumerated Active Directory through firewall-linked service accounts, and used **EarthWorm** and **ReverseSocks5** tunnels for command and control and lateral movement. Researchers warned that thousands of internet-exposed PAN-OS instances remain reachable, making perimeter firewalls with exposed Captive Portal services high-priority compromise candidates.
Jun 29, 2026