Palo Alto Networks has disclosed a critical vulnerability in PAN-OS, tracked as CVE-2026-0300, that is already being actively exploited in the wild.
This vulnerability allows unauthenticated attackers to execute arbitrary code with full root privileges on affected PA-Series and VM-Series firewalls—with no credentials, no user interaction, and no special conditions required.
Because firewalls sit at the core of enterprise network security, this flaw represents a high-impact, high-risk scenario requiring immediate action.
What Is CVE-2026-0300?
CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication Portal (also known as Captive Portal) service of PAN-OS.
By sending specially crafted network packets, an attacker can:
- Trigger an out-of-bounds write (CWE-787)
- Cause a memory corruption condition
- Execute arbitrary code directly on the firewall
- Gain root-level control of the system
Why This Vulnerability Is So Critical
This vulnerability is considered extremely dangerous due to its exploitation characteristics:
- Remote attack vector – can be exploited over the network
- No authentication required – attacker doesn’t need valid credentials
- No user interaction – completely silent exploitation
- Low attack complexity – easy to automate
- Root access – full control of the firewall
👉 Key takeaway: This is a “zero-friction exploitation” scenario that attackers can automate at scale.
When Are You Actually at Risk?
You are vulnerable if ALL the following conditions are true:
- You are running an affected PAN-OS version on PA-Series or VM-Series firewalls
- User-ID Authentication Portal (Captive Portal) is enabled
- The portal is exposed to:
- The internet
- Untrusted network zones
Not affected:
- Prisma Access
- Cloud NGFW
- Panorama
Severity and Real-World Risk
- CVSS Score: 9.3 (Critical) when internet-exposed
- CVSS Score: 8.7 when restricted to trusted networks
Even when slightly reduced, this remains a severe risk.
Why?
Because successful exploitation gives attackers:
✅ Full visibility into network traffic
✅ Ability to intercept or manipulate traffic
✅ Opportunity to harvest credentials
✅ Direct path to lateral movement and network takeover
👉 Firewalls are high-value targets—compromising one can compromise everything behind it.
Affected PAN-OS Versions
If your system is running below the following versions, it is vulnerable:
PAN-OS 10.2
- Below 10.2.7-h34
- Below 10.2.10-h36
- Below 10.2.13-h21
- Below 10.2.16-h7
- Below 10.2.18-h6
PAN-OS 11.1
- Below 11.1.4-h33
- Below 11.1.6-h32
- Below 11.1.7-h6
- Below 11.1.10-h25
- Below 11.1.13-h5
- Below 11.1.15
PAN-OS 11.2
- Below 11.2.4-h17
- Below 11.2.7-h13
- Below 11.2.10-h6
- Below 11.2.12
PAN-OS 12.1
- Below 12.1.4-h5
- Below 12.1.7
Patch Timeline
Palo Alto Networks is rolling out fixes in phases:
- Initial patch rollout: May 13, 2026
- Additional releases: May 28, 2026
👉 Different PAN-OS branches will receive patches at different times
Immediate Mitigation Steps (Critical)
If patching is not yet possible, act immediately:
1) Restrict Authentication Portal access
- Allow only trusted internal IP addresses
- Block access from public internet or untrusted zones
2) Disable Captive Portal (recommended if not required)
- Completely eliminate exposure
- Most effective temporary mitigation
3) Enable Threat Prevention (if available)
- Use available signatures for detection/blocking
- Adds a layer of defense during patch rollout
How to Check If You Are Exposed
Go to:
Device → User Identification → Authentication Portal Settings
Check:
- Is the portal enabled?
- Is it accessible from untrusted networks?
👉 If YES → treat as critical exposure
SOC Monitoring and Threat Hunting
Security teams should actively monitor:
Network-level signals
- External traffic to Captive Portal
- Unusual packet patterns targeting portal endpoints
- High-frequency scanning activity
Firewall behavior anomalies
- Unexpected crashes or restarts
- Configuration changes without approval
- New admin sessions
- Suspicious outbound traffic from the firewall
Post-exploitation indicators
- Unexpected lateral movement attempts
- Internal traffic anomalies originating from the firewall
Common Mistakes to Avoid
❌ Assuming Captive Portal is disabled without verification
❌ Delaying patching because access is restricted
❌ Ignoring “limited exploitation” warnings
❌ Treating firewall vulnerabilities like regular app-level risks
FAQs
What is CVE-2026-0300?
A critical PAN-OS vulnerability allowing unauthenticated remote code execution with root access.
Is this vulnerability actively exploited?
Yes, Palo Alto confirms active exploitation in real-world attacks.
Who is most at risk?
Organizations with Captive Portal exposed to the internet or untrusted networks.
What is the fastest mitigation?
Disable Captive Portal or restrict it to trusted IPs only.
When should I patch?
Immediately when your PAN-OS version receives the update.
Conclusion
CVE-2026-0300 is a critical, actively exploited vulnerability that enables attackers to take full control of enterprise firewalls.
Because these systems sit at the network perimeter, compromise impact is massive.
✅ Priority actions:
- Check if Captive Portal is enabled
- Restrict or disable access immediately
- Patch as soon as updates are available
- Monitor for suspicious activity
