CVE-2026-0300criticalunder attackCWE-787

CVE-2026-0300: critical vulnerability in Palo Alto Networks PAN-OS

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

Published · Updated

Follow this CVE+ Monitor PAN-OS+ Monitor Prisma Access

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 9.3epss 42%
from disclosure to weapon15 days
Published on NVDMay 6
1st PoC+15d
CISA KEVMay 6
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 33/2026Vulnerabilidade Crítica no PAN-OS - Palo Alto Networksread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-05-09

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

In short

A buffer overflow flaw in Palo Alto Networks PAN-OS User-ID Authentication Portal lets an unauthenticated attacker send malicious packets to execute code with root access on firewalls. This is critical because no login is required, giving attackers direct control over the device.

Technical detail

An unauthenticated buffer overflow vulnerability exists in the User-ID Authentication Portal service (CWE-787), exploitable via specially crafted network packets to achieve remote code execution with root privileges on PA-Series and VM-Series appliances. The attack requires network access to the portal but no authentication; mitigation is available by restricting portal access to trusted IP ranges per security best practices.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red
Affected products
Palo Alto Networks · Cloud NGFWPalo Alto Networks · PAN-OSPalo Alto Networks · Prisma Access
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Palo Alto Networks PAN-OS

In the same product, most dangerous first.

CVE-2024-3400CRITICALPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectEPSS 100.0%KEVCVE-2024-0012CRITICALPAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)EPSS 99.8%KEVCVE-2025-0108HIGHPAN-OS: Authentication Bypass in the Management Web InterfaceEPSS 98.5%KEVCVE-2026-0257HIGHPAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesEPSS 95.6%KEVCVE-2024-9474MEDIUMPAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceEPSS 93.8%KEVCVE-2024-3393HIGHPAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted PacketEPSS 29.1%KEV