Loading vulnerability…
Improper Validation of Terminal Server Agent Certificate in PAN-OS
CVE-2026-0228 is an improper certificate validation vulnerability in PAN-OS affecting the validation of certificates presented by Terminal Server Agents on Windows. Due to insufficient enforcement of certificate validity checks, PAN-OS can allow a Windows Terminal Server Agent to connect using an expired certificate even when the configured policy would normally reject such a connection. This weakens the intended certificate-based trust model between PAN-OS and Terminal Server Agents and creates a path for policy bypass involving agent authentication or registration.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a Terminal Server Agent using an expired certificate to establish a connection to PAN-OS despite configuration that should prevent it. The primary impact is bypass of certificate-based security controls and weakening of trust enforcement for agent connections. Depending on deployment and reliance on Terminal Server Agent identity and trust, this could permit unauthorized or noncompliant agent connectivity and reduce the effectiveness of administrative security policy.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by tightly controlling which Terminal Server Agents are permitted to connect, reviewing certificate lifecycle management to identify expired agent certificates, and monitoring for unexpected or noncompliant agent connections. Because the issue is rooted in improper certificate validation, mitigation is limited; applying the vendor fix is the reliable corrective action.
Patch, then assume compromise.
Upgrade affected PAN-OS deployments to a fixed release. Reported fixed versions include PAN-OS 12.1.4 and later, PAN-OS 11.2.10 and later, PAN-OS 11.1.11 and later, and PAN-OS 10.2.17 and later. Administrators should also review associated Prisma Access release guidance where PAN-OS-based components are affected and ensure all relevant appliances are updated to vendor-recommended versions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.