---

📋 Overview

A critical buffer overflow vulnerability (CWE-787) in the User-ID Authentication Portal of PAN-OS allows unauthenticated attackers to achieve remote code execution with root privileges by sending specially crafted packets.

CVE ID: CVE-2026-0300
CVSS 4.0 Score: 9.3 (Critical)
Urgency: HIGHEST

---

🛠️ Affected Products

• PA-Series Firewalls
• VM-Series Firewalls

Affected PAN-OS Versions

Not affected: Cloud NGFW, Prisma Access, Panorama (in most configurations)

---

🔍 Vulnerability Details

• Type: Buffer Overflow (Out-of-bounds Write)
• Component: User-ID™ Authentication Portal (Captive Portal)
• Attack Vector: Network (Unauthenticated)
• Privileges Required: None
• User Interaction: None
• Impact: Root-level arbitrary code execution

Exploitation Condition: The User-ID Authentication Portal must be enabled and reachable from untrusted networks (e.g., internet-exposed).

---

📸 Demo

---

⚠️ Exploitation Status

Actively exploited in the wild (as of May 6, 2026).

Limited real-world attacks have been observed targeting exposed User-ID portals.

---

🛡️ Mitigation & Workarounds (Immediate Action Required)

1. Recommended Workarounds (Until patches are available)

• Restrict access to the User-ID Authentication Portal to trusted IP addresses only.
• Disable the Captive Portal / User-ID portal if not required.
• Block access to the portal on untrusted interfaces (e.g., via security policies).

2. Apply Official Patches

Patches start rolling out from May 13, 2026.

---

📌 References

• Official Advisory: Palo Alto Networks - CVE-2026-0300
• The Hacker News: PAN-OS Flaw Under Active Exploitation
• SecurityWeek: Palo Alto Zero-Day Exploited

---

🛠️ Detection & Hunting Tips

• Look for unusual traffic to /php/login.php or Captive Portal endpoints.
• Monitor for unexpected processes or reboots on firewalls.
• Enable PAN-OS threat prevention and strict zone-based policies.

---

Stay Secure — Review your firewall exposure today.

---

Last Updated: May 6, 2026