PAN-OS: Improper Validation of Terminal Server Agent Certificate

An attacker with access to an expired Terminal Server Agent certificate could connect to PAN-OS and potentially access systems protected by Prisma Access, bypassing normal certificate validation controls.

Organizations using Palo Alto Networks Prisma Access for remote access and endpoint protection should apply this update. This is most critical for companies that manage distributed workforces, remote offices, or branch locations where Terminal Server Agents are deployed on Windows endpoints.

An attacker obtains or creates an expired Terminal Server Agent certificate, then connects it to a PAN-OS instance running Prisma Access. Because the firewall does not properly validate the certificate expiration, the connection succeeds even though the organization's security policy would normally reject expired certificates.