HackZoneLabs News
Newsletter

CVE-2026-0300

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

  • Critical 9.3
  • Exploited: added to CISA KEV 6 May 2026

Description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Key facts

Published
6 May 2026
Last changed
15 Oct 2026
Assigned by
palo_alto
KEV added
6 May 2026
KEV fix due
9 May 2026
EPSS
41.714% likely to be exploited in the next 30 days, higher than 98.708% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 9.3CVSS 4.0, Criticalfrom the CNA (palo_alto)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red
  • 8.7CVSS 4.0, Highfrom the CNA (palo_alto)CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red

What to do

  • Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-100 Overflow Buffers (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
Palo Alto NetworksCloud NGFW
  • Default status: unaffected
  • All (unaffected)
Palo Alto NetworksPAN-OS
  • Default status: unaffected
  • 12.1.0 up to but excluding 12.1.7 (affected); at 12.1.7 unaffected, at 12.1.4-h5 unaffected
  • 11.2.0 up to but excluding 11.2.12 (affected); at 11.2.12 unaffected, at 11.2.10-h6 unaffected, at 11.2.7-h13 unaffected, at 11.2.4-h17 unaffected
  • 11.1.0 up to but excluding 11.1.15 (affected); at 11.1.15 unaffected, at 11.1.13-h5 unaffected, at 11.1.10-h25 unaffected, at 11.1.7-h6 unaffected, at 11.1.6-h32 unaffected, at 11.1.4-h33 unaffected
  • 10.2.0 up to but excluding 10.2.18-h6 (affected); at 10.2.18-h6 unaffected, at 10.2.16-h7 unaffected, at 10.2.13-h21 unaffected, at 10.2.10-h36 unaffected, at 10.2.7-h34 unaffected
Palo Alto NetworksPrisma Access
  • Default status: unaffected
  • All (unaffected)

Timeline

  1. 5 May 2026 Initial publication.
  2. 6 May 2026 CVE-2026-0300 added to CISA KEV
  3. 6 May 2026 Added to the CISA KEV catalogue
  4. 6 May 2026 Updated with Threat Prevention ID and clarified the Required Configuration section.
  5. 6 May 2026 Published

Weakness

References