PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
- Severity
- High7.5CVSS 3.1, High
- EPSS
- 0.83%
- Published
- 8 Jul 2026
- Updated
- 11 Aug 2026
Description
Title, description and vendor guidance are quoted from the source records.
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.
Weakness: CWE-787
Known exploited
Not listed in CISA KEV as of the last check.
Exploit prediction
0.83% probability of exploitation in the next 30 days (percentile 56%).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
What the source states, per branch
Versions matched by Patcharo
Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)
| Branch | Affected | Fixed in |
|---|---|---|
| 12.1 | >= 12.1.0, < 12.1.4-h8 >= 12.1.5, < 12.1.7-h2 | 12.1.4-h8 12.1.7-h2 |
| 11.2 | >= 11.2.0, < 11.2.4-h20 >= 11.2.5, < 11.2.7-h18 >= 11.2.8, < 11.2.10-h12 >= 11.2.11, < 11.2.13 | 11.2.4-h20 11.2.7-h18 11.2.10-h12 11.2.13 |
| 11.1 | >= 11.1.0, < 11.1.4-h35 >= 11.1.5, < 11.1.6-h35 >= 11.1.7, < 11.1.7-h8 >= 11.1.8, < 11.1.10-h30 >= 11.1.11, < 11.1.13-h9 >= 11.1.14, < 11.1.16 | 11.1.4-h35 11.1.6-h35 11.1.7-h8 11.1.10-h30 11.1.13-h9 11.1.16 |
| 10.2 | >= 10.2.0, < 10.2.7-h36 >= 10.2.8, < 10.2.10-h39 >= 10.2.11, < 10.2.13-h23 >= 10.2.14, < 10.2.16-h9 >= 10.2.17, < 10.2.18-h8 | 10.2.7-h36 10.2.10-h39 10.2.13-h23 10.2.16-h9 10.2.18-h8 |
Versions not listed are stated unaffected by the vendor.
Affected products
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Prisma Access · 11.2.0 < 11.2.7-h18, 10.2.0 < 10.2.10-h39
Workaround / Vendor remediation
Workaround · PAN-OS
The vast majority of firewalls already follow Palo Alto Networks' and industry best practices. However, if you have not already, we strongly recommend that you restrict your User-ID Terminal Server Agent connectivity to only trusted internal IP addresses according to our best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only.
Vendor remediation · PAN-OS
Version Minor Version Suggested Solution Cloud NGFWNo action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN-OS 11.2 11.2.0 through 11.2.12 Upgrade to 11.2.13 or later. 11.2.0 through 11.2.10-h* Upgrade to 11.2.10-h12 or 11.2.13 or later. 11.2.0 through 11.2.7-h* Upgrade to 11.2.7-h18 or 11.2.13 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h20 or 11.2.13 or later. PAN-OS 11.1 11.1.0 through 11.1.15 Upgrade to 11.1.16 or later. 11.1.0 through 11.1.13-h* Upgrade to 11.1.13-h9 or 11.1.16 or later. 11.1.0 through 11.1.10-h* Upgrade to 11.1.10-h30 or 11.1.16 or later. 11.1.0 through 11.1.7-h* Upgrade to 11.1.7-h8 or 11.1.16 or later. 11.1.0 through 11.1.6-h* Upgrade to 11.1.6-h35 or 11.1.16 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h35 or 11.1.16 or later. PAN-OS 10.…
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC