CVE-2026-0228: PAN-OS Auth Bypass Vulnerability

CVE-2026-0228 Overview

An improper certificate validation vulnerability exists in Palo Alto Networks PAN-OS that allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates, bypassing configuration restrictions that would normally prevent such connections. This vulnerability (CWE-295) represents a weakness in the certificate validation logic that could allow unauthorized connections through the improper acceptance of expired credentials.

Critical Impact

Attackers with low privileges can bypass certificate expiration checks to establish unauthorized Terminal Server Agent connections, potentially compromising the integrity of network access controls and downstream systems.

Affected Products

• Palo Alto Networks PAN-OS (specific versions to be confirmed via vendor advisory)
• Windows Terminal Server Agents connecting to PAN-OS
• Environments using certificate-based authentication for Terminal Server Agent connections

Discovery Timeline

• February 11, 2026 - CVE-2026-0228 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0228

Vulnerability Analysis

This vulnerability stems from improper certificate validation (CWE-295) in the PAN-OS authentication mechanism for Terminal Server Agents. The flaw allows Windows-based Terminal Server Agents to establish connections to PAN-OS infrastructure using certificates that have expired, even when the PAN-OS configuration explicitly requires valid, unexpired certificates.

The vulnerability can be exploited over the network by authenticated users with low privileges. While the attack does not require user interaction, the overall impact is limited due to the specific conditions required for exploitation. The primary concern is integrity impact on the vulnerable system and limited confidentiality impact on downstream systems.

Root Cause

The root cause lies in insufficient validation of certificate expiration dates during the Terminal Server Agent authentication process. When a Windows Terminal Server Agent attempts to connect to PAN-OS, the certificate validation routine fails to properly enforce expiration checks, allowing certificates that should be rejected to be accepted for authentication purposes. This represents a gap between the intended security policy configured in PAN-OS and the actual enforcement behavior.

Attack Vector

The attack vector is network-based, requiring an attacker to have access to a Windows system with a Terminal Server Agent and a previously valid (but now expired) certificate. The attacker can leverage this expired certificate to establish a connection to PAN-OS that should be denied according to the security configuration.

The exploitation flow involves:

1. An attacker obtains or retains an expired certificate previously used for Terminal Server Agent authentication
2. The attacker configures a Windows Terminal Server Agent with this expired certificate
3. Upon connection attempt, PAN-OS improperly validates the certificate, accepting it despite expiration
4. The connection is established, bypassing the intended certificate lifecycle controls

For detailed technical information about the exploitation mechanism, refer to the Palo Alto Networks Security Advisory.

Detection Methods for CVE-2026-0228

Indicators of Compromise

• Terminal Server Agent connections authenticated with certificates that have expired timestamps
• Authentication logs showing successful connections from agents using certificates beyond their validity period
• Unexpected Terminal Server Agent connections from systems with outdated certificate configurations

Detection Strategies

• Monitor PAN-OS authentication logs for Terminal Server Agent connections and cross-reference certificate validity dates
• Implement certificate inventory tracking to identify any certificates approaching or past expiration that remain in use
• Deploy network monitoring to detect Terminal Server Agent traffic patterns that may indicate exploitation attempts
• Enable verbose logging for certificate-based authentication events on PAN-OS systems

Monitoring Recommendations

• Regularly audit Terminal Server Agent connections and validate certificate status for all active connections
• Configure alerts for authentication attempts using certificates within a defined threshold of expiration
• Review PAN-OS configuration periodically to ensure certificate validation policies are correctly applied
• Implement certificate lifecycle management with automated expiration notifications

How to Mitigate CVE-2026-0228

Immediate Actions Required

• Review all Terminal Server Agent connections and revoke access for any using expired certificates
• Audit certificate configurations on Windows systems running Terminal Server Agents
• Apply vendor patches as soon as they become available from Palo Alto Networks
• Implement additional network controls to validate certificate status before allowing connections

Patch Information

Palo Alto Networks has published a security advisory for this vulnerability. Administrators should consult the Palo Alto Networks Security Advisory for detailed patch information, affected version specifics, and remediation guidance. Apply the recommended patches following your organization's change management procedures.

Workarounds

• Implement certificate revocation checking (CRL or OCSP) as an additional layer of validation
• Rotate and replace expired certificates immediately on all Terminal Server Agent deployments
• Configure network segmentation to limit Terminal Server Agent connection sources to trusted networks only
• Consider implementing additional authentication factors beyond certificate validation until patches are applied

# Verify Terminal Server Agent certificate status
# Run on Windows systems with TS Agent installed
certutil -verify -urlfetch <certificate_path>

# Check certificate expiration date
openssl x509 -enddate -noout -in <certificate_file>

# Review PAN-OS certificate configuration (from CLI)
show user ts-agent state all