CVE-2026-0288
EPSS 0.8% (55th percentile).
Vulnerabilities · 92 days ago
The clean-up is broader than a firewall update. Palo Alto’s fix set now has to cover both PA- and VM-Series appliances and Panorama, because the advisory spans management-plane and data-plane flaws, not one isolated bug class.
NCSC’s public advisory says ten PAN-OS flaws are fixed, including CVE-2026-0288. The list covers XSS in user-facing portals, session-token exposure, auth bypass in LSVPN, SSRF, command injection in the management plane, DoS conditions, and a buffer overflow in the User-ID Terminal Server Agent. That leaves mixed estates with more than one patch target, so a partial rollout can still leave centralized administration or exposed management surfaces behind.
EPSS 0.8% (55th percentile).
3 sources covering this story
Kwetsbaarheden verholpen in Palo Alto Networks PAN-OS
Palo Alto Networks heeft meerdere kwetsbaarheden verholpen in PAN-OS software, specifiek in PA-Series en VM-Series firewalls, evenals Panorama management platforms.
Palo Alto Networks Patches 13 Vulnerabilities
Buffer overflow, DoS, command injection, SSRF, authentication bypass, and other types of vulnerabilities have been found in PAN-OS software.
Palo Alto Networks: risolte vulnerabilità in PAN-OS e Prisma Access
Risolte diverse vulnerabilità di sicurezza, di cui una con gravità “alta”, nei prodotti PAN-OS e Prisma Access di Palo Alto Networks.
Vendor digest: Palo Alto Networks
Part of the PlainSec briefing for 2026-07-13