PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

A buffer overflow flaw in Palo Alto Networks PAN-OS User-ID Authentication Portal lets an unauthenticated attacker send malicious packets to execute code with root access on firewalls. This is critical because no login is required, giving attackers direct control over the device.

An unauthenticated buffer overflow vulnerability exists in the User-ID Authentication Portal service (CWE-787), exploitable via specially crafted network packets to achieve remote code execution with root privileges on PA-Series and VM-Series appliances. The attack requires network access to the portal but no authentication; mitigation is available by restricting portal access to trusted IP ranges per security best practices.