Palo Alto Networks Security Advisories / CVE-2026-0228

CVE-2026-0228 PAN-OS: Improper Validation of Terminal Server Agent Certificate

Urgency MODERATE

047910
Severity 1.3 · LOW
Exploit Maturity UNREPORTED
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction NONE
Product Confidentiality NONE
Product Integrity LOW
Product Availability NONE
Privileges Required LOW
Subsequent Confidentiality LOW
Subsequent Integrity NONE
Subsequent Availability NONE
CVE JSON CSAF
Published 2026-02-11
Updated 2026-02-11
Discovered externally

Description

An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even if the PAN-OS configuration would not normally permit them to do so.

Product Status

VersionsAffectedUnaffected
Cloud NGFWNone
All
PAN-OS 12.1None
All
PAN-OS 11.2< 11.2.8
>= 11.2.8
PAN-OS 11.1< 11.1.11
>= 11.1.11
PAN-OS 10.2< 10.2.17
>= 10.2.17
Prisma Access< 10.2.10-h28 on PAN-OS
< 11.2.7-h10 on PAN-OS
>= 10.2.10-h28 on PAN-OS
>= 11.2.7-h10 on PAN-OS

Required Configuration for Exposure

This issue only affects PAN-OS devices that connect to Terminal Server agents on Windows.

Follow these steps to check if PAN-OS devices connect to the Terminal Server agent:

Device > User Identification > Terminal Server Agents

Severity: LOW, Suggested Urgency: MODERATE

CVSS-BT: 1.3 / CVSS-B: 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-295 Improper Certificate Validation

CAPEC-114 Authentication Abuse

Solution

Version
Minor Version
Suggested Solution
Cloud NGFW
No action needed.
PAN-OS 12.1
No action needed.
PAN-OS 11.2
 11.2.0 through 11.2.7 Upgrade to 11.2.8 or later.
PAN-OS 11.1
 11.1.0 through 11.1.10 Upgrade to 11.1.11 or later.
PAN-OS 10.2
 10.2.0 through 10.2.16 Upgrade to 10.2.17 or later.
All older
unsupported
PAN-OS versions		 Upgrade to a supported fixed version.
Prisma Access 11.2 on PAN-OS
 11.2.0 through 11.2.7 Upgrade to 11.2.7-h10 or later.
Prisma Access 10.2 on PAN-OS 10.2.0 through 10.2.10 Upgrade to 10.2.10-h28 or later.

Workarounds and Mitigations

No known workarounds exist for this issue.

Acknowledgments

Palo Alto Networks thanks Paolo Nero of Wellcomm Engineering for discovering and reporting this issue.

CPEs

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*

CPE Applicability

Timeline

Initial Publication
Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure PolicyReport vulnerabilitiesManage subscriptions
© 2026 Palo Alto Networks, Inc. All rights reserved.