MSRXCVE-2026-0300
CVE-2026-0300
PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
CVSS 4.0 · CNA
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
Scores
Affected products
- Palo Alto Networks Cloud NGFW: see advisory
- Palo Alto Networks PAN-OS: 12.1.0 to < 12.1.7; 11.2.0 to < 11.2.12; 11.1.0 to < 11.1.15; 10.2.0 to < 10.2.18-h6
- Palo Alto Networks Prisma Access: see advisory
Weakness: CWE-787
1 references (advisories, patches, write-ups)
- https://security.paloaltonetworks.com/CVE-2026-0300 · vendor-advisory
Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.