How severe is CVE-2026-0300?

CVE-2026-0300 has a CVSS 4.0 base score of 9.3 (CRITICAL). EPSS estimates a 31.7% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-0300: PAN-OS: Unauthenticated user initiated Buffer Overflow

CISA Known Exploited Vulnerabilities

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2026-05-06

Remediation due

2026-05-09

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

CISA notes
https://security.paloaltonetworks.com/CVE-2026-0300 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0300

Description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Severity

CVSS 4.0 · CNA9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red

CVSS 4.0 · CNA8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Palo Alto Networks	Cloud NGFW	All (unaffected)
Palo Alto Networks	PAN-OS	12.1.0 to <12.1.7 (fixed ≥ 12.1.7, 12.1.4-h5) 11.2.0 to <11.2.12 (fixed ≥ 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17) 11.1.0 to <11.1.15 (fixed ≥ 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33) 10.2.0 to <10.2.18-h6 (fixed ≥ 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34)
Palo Alto Networks	Prisma Access	All (unaffected)

References

1 Links

Vendor advisories

https://security.paloaltonetworks.com/CVE-2026-0300

Record Details

Published

2026-05-06

Last updated

2026-07-14

Assigner (CNA)

palo_alto

Credited to

More from Palo Alto Networks

CVE-2024-340010

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

CVE-2024-00129.3

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

CVE-2024-94659.2

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

CVE-2024-94639.9

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-787 · Out-of-bounds Write

Fuzzing Binary Exploitation

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.