CVE-2026-0300
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
Description
CVE-2026-0300 is a CRITICAL out-of-bounds write (buffer overflow) vulnerability in the User-ID Authentication Portal (also known as the Captive Portal) service of Palo Alto Networks PAN-OS, with a CVSS 3.1 score of 9.8. The flaw lives in the PA-Series and VM-Series firewall code path that handles inbound authentication-portal traffic and allows an unauthenticated attacker to execute arbitrary code with root privileges by sending specially crafted packets to the portal service. Affected versions span the PAN-OS 10.2, 11.1, 11.2, and 12.1 release branches up to and including the latest pre-patch releases. Prisma Access, Cloud NGFW, and Panorama appliances are not affected. CISA added CVE-2026-0300 to the KEV catalog on May 6, 2026, with a three-day remediation deadline of May 9, 2026, signalling confirmed exploitation in the wild. The EPSS score of 0.053 (90.1 percentile) reflects elevated active exploitation pressure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | 10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 10.2.5; 10.2.6; 10.2.7; 10.2.8; 10.2.9; 10.2.10; 10.2.11; 10.2.12; 10.2.13; 10.2.14; 10.2.15; 10.2.16; 10.2.17; 10.2.18; 11.1.0; 11.1.1; 11.1.2; 11.1.3; 11.1.4; 11.1.5; 11.1.6; 11.1.7; 11.1.8; 11.1.9; 11.1.10; 11.1.11; 11.1.12; 11.1.13; 11.1.14; 11.2.0; 11.2.1; 11.2.2; 11.2.3; 11.2.4; 11.2.5; 11.2.6; 11.2.7; 11.2.8; 11.2.9; 11.2.10; 11.2.11; 12.1.2; 12.1.3; 12.1.4; 12.1.5; 12.1.6 |
| siemens | ruggedcom ape1808 firmware | - |
References
- https://security.paloaltonetworks.com/CVE-2026-0300(Mitigation, Vendor Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-967325.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 describes a memory-safety flaw in which software writes data past the end of a buffer or to an address that lies before the buffer start, corrupting adjacent memory. In CVE-2026-0300, the User-ID Authentication Portal service in PAN-OS processes attacker-supplied packet data without adequately validating its size or structure before copying it into a fixed-size buffer. The resulting out-of-bounds write allows the attacker to corrupt control structures in the service process, ultimately steering execution into attacker-controlled code with root privileges on the firewall. Because the vulnerable parsing occurs before any authentication step, no credentials are required to reach the flaw.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2026-0300 carries a CVSS 3.1 score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: unauthenticated, network-reachable, low complexity, no user interaction, and uniform High impact on Confidentiality, Integrity, and Availability. A successful exploit yields root code execution on the firewall data plane. Practical consequences include full visibility into and modification of all traffic the firewall inspects, theft or alteration of PAN-OS configuration including IPsec and SSL VPN secrets, persistent backdoor installation in the firewall image, and pivoting into the protected network because the firewall is, by definition, on-path between attacker and protected assets. PAN-OS firewalls are routinely terminating points for SSL VPN access, so a compromise also implies access to remote-worker credential flows and post-authentication trust. The User-ID Authentication Portal is the captive-portal interface for user identification, typically reachable on network segments that include user devices and sometimes guest networks, expanding the practical attack surface beyond classic management-plane CVEs.
Exploit Maturity
Public Exploits: Palo Alto Networks published Security Advisory PAN-SA CVE-2026-0300 with mitigation guidance. No public proof-of-concept code has appeared at the time of writing, but the advisory text and CISA KEV listing indicate that working exploitation primitives are known to attackers. Active Exploitation: CISA added CVE-2026-0300 to the KEV catalog on May 6, 2026, with a remediation deadline of May 9, 2026. The three-day deadline is reserved for vulnerabilities under confirmed exploitation against federal civilian agencies. Exploitation Probability: The EPSS score of 0.053 (90.1 percentile) places this CVE in the upper tenth of the entire CVE population by predicted exploitation likelihood. Practical Risk: Internet-facing PAN-OS firewalls with the User-ID Authentication Portal enabled and reachable from untrusted networks are at imminent risk; previous critical PAN-OS pre-auth RCEs (CVE-2024-3400, CVE-2025-0108) were exploited at internet scale within days of disclosure, and the same trajectory should be assumed here.
Remediation
- Upgrade PAN-OS immediately to a patched release. Apply the patched version for the affected branch per the PAN-SA advisory: 10.2, 11.1, 11.2, and 12.1 each have a remediated build identified in the advisory. Update every PA-Series and VM-Series firewall on the patched release for the branch in production, including HA pairs and disaster-recovery instances.
- Apply the vendor workaround until patched. The CISA-published workaround restricts User-ID Authentication Portal access to trusted zones only, or disables the User-ID Authentication Portal if it is not required for the business case. Apply the workaround on every firewall that cannot be patched in the same maintenance window. Both controls remove the unauthenticated reachable path while leaving other firewall services unaffected.
- Hunt for compromise. Inspect PAN-OS system logs and packet-capture stores from at least April 1, 2026 for unusual or malformed traffic to the User-ID Authentication Portal service. Review configuration audit logs for unexpected changes since that date, especially changes to administrator accounts, IPsec and SSL VPN settings, and certificate stores. Where possible, rotate IPsec pre-shared keys, SSL VPN certificates, and administrator credentials on any firewall that was exposed and unpatched before the disclosure.
- Reduce User-ID Authentication Portal exposure. Long-term, restrict the captive portal to internal management VLANs only, or replace it with an out-of-band identity mechanism for users who genuinely need captive-portal authentication. Reduce the practical attack surface to networks under organizational control rather than the public internet.
- Long-term hardening. Apply the CWE-787 mitigation principles in dependency review: pre-auth parsers for binary protocols on network-edge devices remain a recurring source of critical CVEs, and Palo Alto Networks has had multiple in the last 18 months. Subscribe to Palo Alto Networks PSIRT advisories, treat KEV-listed PAN-OS CVEs with an emergency 24-hour SLA, and maintain an inventory of every PAN-OS device with its current version and exposed services for fast triage on future disclosures.
Technical Details
CVE-2026-0300 is a CWE-787 out-of-bounds write flaw in the User-ID Authentication Portal (Captive Portal) service of PAN-OS on PA-Series and VM-Series firewalls. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms unauthenticated, low-complexity reachability over the network with full High impact on Confidentiality, Integrity, and Availability. The captive portal handles inbound HTTP/HTTPS authentication-portal requests on a defined set of TCP ports per firewall configuration; the vulnerable code copies attacker-influenced packet data into a fixed-size buffer without sufficient bounds checking, producing an out-of-bounds write that can be steered to overwrite control structures and ultimately gain root execution in the service. The affected version surface is unusually broad, covering essentially the entire 10.2, 11.1, 11.2, and 12.1 release lineage, indicating that the defective code has been present and shipped across multiple major-release cycles. Prisma Access, Cloud NGFW, and Panorama are explicitly not impacted, which narrows the scope to on-premise PA-Series and VM-Series firewall data planes. The vendor workaround targets the reachability of the captive portal rather than the underlying parser, which is consistent with a parser-rewrite-style fix rather than a quick configuration mask.
Frequently Asked Questions
Is CVE-2026-0300 being actively exploited?
Yes. CISA added CVE-2026-0300 to the KEV catalog on May 6, 2026, with a three-day remediation deadline of May 9, 2026. The deadline length is reserved for CVEs under confirmed active exploitation. The EPSS score of 0.053 (90.1 percentile) reflects elevated continued exploitation pressure.
Which PAN-OS versions are affected?
PAN-OS 10.2, 11.1, 11.2, and 12.1 releases up to the latest pre-patch builds are vulnerable on PA-Series and VM-Series firewalls. Refer to the PAN-SA CVE-2026-0300 advisory for the exact remediated build per branch. Prisma Access, Cloud NGFW, and Panorama are not affected.
What can I do if I cannot patch immediately?
Apply the vendor workaround: restrict User-ID Authentication Portal access to trusted zones only, or disable the User-ID Authentication Portal if it is not required. Both controls remove the unauthenticated reachable path. The workaround is a temporary measure and the patch should still be applied as soon as the operational maintenance window allows.
How do I check whether my firewall was compromised before patching?
Review PAN-OS system logs and any packet captures from at least April 1, 2026 for unusual or malformed traffic targeting the User-ID Authentication Portal service. Audit configuration change logs for unexpected modifications to administrator accounts, VPN settings, and certificate stores. Where exposure was significant and unpatched, rotate IPsec pre-shared keys, SSL VPN certificates, and administrator credentials, and consider re-imaging the device from a known-clean firmware build.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.