CVE-2026-0300

What is PAN-OS?

PAN-OS is the operating system powering Palo Alto Networks' next-generation firewalls (NGFWs), including the PA-Series hardware appliances and VM-Series virtual firewalls. These devices are deployed as network perimeter controls, data center security gateways, and internet edge firewalls across enterprises, government agencies, and critical infrastructure globally.

PAN-OS firewalls are high-value targets for attackers because they sit at network chokepoints — exploiting one typically grants an unauthenticated attacker a pivot point inside the defended network with root-level access to the security device itself.

Overview

CVE-2026-0300 is a buffer overflow (out-of-bounds write, CWE-787) in the User-ID Authentication Portal (also known as the Captive Portal service) of Palo Alto Networks PAN-OS. An unauthenticated remote attacker can send specially crafted packets to the portal to trigger the overflow and execute arbitrary code with root privileges on the firewall.

The vulnerability is rated CRITICAL at CVSS 9.3 and is being actively exploited in the wild. Palo Alto Networks has rated the urgency HIGHEST. Patches are expected between May 13–28, 2026 depending on the PAN-OS branch.

Affected Versions

Not affected: Cloud NGFW, Prisma Access, Panorama.

Exposure Conditions

The vulnerability is only reachable when both conditions are met:

1. User-ID Authentication Portal is enabled on the interface
2. The interface's management profile has Response Pages enabled and is accessible from the internet

If the Authentication Portal is only reachable from trusted internal zones, the attack surface is substantially reduced — but not eliminated, as insider threats or already-compromised internal hosts could still exploit it.

Technical Details

The flaw is an out-of-bounds write (CWE-787) — a class of memory corruption vulnerability where a write operation exceeds the bounds of an allocated buffer. In PAN-OS, the Captive Portal / User-ID Authentication Portal service fails to properly validate the size or contents of attacker-controlled input in incoming packets. A crafted packet triggers a write past the end of a stack or heap buffer, overwriting adjacent memory including control structures (e.g., return addresses, function pointers).

Because the Authentication Portal runs with root privileges, successful exploitation grants the attacker code execution at the highest privilege level on the firewall OS — full device compromise.

Discovery

Palo Alto Networks' advisory attributes discovery to in-production exploitation, meaning the vulnerability was first identified through threat intelligence observing active attacks against real-world deployments — not through researcher-initiated responsible disclosure. This is consistent with the zero-day nature of the exploit at time of disclosure: no patch was available when CISA added it to the KEV catalog.

Exploitation Context

Palo Alto Networks confirmed limited exploitation in production as of the May 5–6, 2026 advisory publication. The combination of:

• Pre-authentication (no credentials needed)
• Network-accessible attack surface (Captive Portal exposed to internet in many enterprise configurations)
• Root-level code execution on a network security appliance

makes this an extremely attractive initial-access vector for both nation-state actors and financially motivated threat groups. Firewalls with Captive Portal exposed to the public internet are discoverable via Shodan/Censys queries targeting PAN-OS management interfaces.

The 3-day CISA KEV deadline (added May 6, deadline May 9) reflects the severity of confirmed in-the-wild exploitation and the criticality of affected assets.

Remediation

1. Restrict Authentication Portal access to trusted zones only — In the interface management profile, limit Response Pages to internal/trusted source IPs. Remove internet-facing exposure of the Authentication Portal immediately.

2. Disable User-ID Authentication Portal if not needed — If Captive Portal / User-ID Authentication Portal is not actively used, disable it entirely. This eliminates the attack surface.

3. Enable Threat Prevention (PAN-OS 11.1+ only) — Enable Threat ID 510019 on security policies covering the Authentication Portal traffic with a Threat Prevention subscription. This provides detection and blocking of known exploit attempts.

4. Apply hotfixes as soon as released — Monitor the Palo Alto Networks advisory and apply the appropriate fixed version for your branch (10.2.x, 11.1.x, 11.2.x, or 12.1.x) as soon as it becomes available.

5. Review firewall logs for exploitation indicators — Check for anomalous traffic to the Authentication Portal from external IPs, unexpected root-level process activity, or outbound connections from the firewall to unknown hosts.