CVE-2026-0228 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-0228 PUBLISHED CVSS 1.2999999523162842 LOW

An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even if the PAN-OS configuration would not normally permit them to do so.

EPSS 0.01% · 1.3th percentile

Risk Scores

CVSS v4.0

1.2999999523162842

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

EPSS Score

0.01%

1.3th percentile

Affected Products

Vendor	Product	Versions
palo_alto_networks	prisma_access	11.2.7, 10.2.10
Palo Alto Networks	PAN-OS	12.1.0, 11.2.0, 11.1.0
Palo Alto Networks	Cloud NGFW	All
palo_alto_networks	pan-os	11.1.0, 10.2.0, 11.2.0
Palo Alto Networks	Prisma Access	10.2.0

Timeline

Nov 3, 2025 CVE ID Reserved
Feb 11, 2026 CVE Published
Feb 11, 2026 PoC Published
Feb 11, 2026 PoC Published
Feb 11, 2026 CVE Updated
Feb 11, 2026 PoC Published
Feb 12, 2026 EPSS Score
Feb 12, 2026 PoC Published
Feb 13, 2026 EPSS Score
Feb 15, 2026 EPSS Score
Feb 16, 2026 EPSS Score
Feb 18, 2026 EPSS Score

References

https://security.paloaltonetworks.com/CVE-2026-0229 advisory
https://security.paloaltonetworks.com/PAN-SA-2026-0002 advisory
https://security.paloaltonetworks.com/CVE-2026-0228 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-0228 advisory

Open in Interactive Console →