CVE-2026-0300
Last modified
CVE-2026-0300 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.. CISA has confirmed active exploitation in the wild. EPSS estimates a 36.16% chance of exploitation in the next 30 days.
Description
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Pan-Os | 10.2.0 |
| Paloaltonetworks | Pan-Os | 10.2.1 |
| Paloaltonetworks | Pan-Os | 10.2.2 |
| Paloaltonetworks | Pan-Os | 10.2.3 |
| Paloaltonetworks | Pan-Os | 10.2.4 |
| Paloaltonetworks | Pan-Os | 10.2.5 |
| Paloaltonetworks | Pan-Os | 10.2.6 |
| Paloaltonetworks | Pan-Os | 10.2.7 |
| Paloaltonetworks | Pan-Os | 10.2.8 |
| Paloaltonetworks | Pan-Os | 10.2.9 |
| Paloaltonetworks | Pan-Os | 10.2.10 |
| Paloaltonetworks | Pan-Os | 10.2.11 |
| Paloaltonetworks | Pan-Os | 10.2.12 |
| Paloaltonetworks | Pan-Os | 10.2.13 |
| Paloaltonetworks | Pan-Os | 10.2.14 |
| Paloaltonetworks | Pan-Os | 10.2.15 |
| Paloaltonetworks | Pan-Os | 10.2.16 |
| Paloaltonetworks | Pan-Os | 10.2.17 |
| Paloaltonetworks | Pan-Os | 10.2.18 |
| Paloaltonetworks | Pan-Os | 11.1.0 |
| Paloaltonetworks | Pan-Os | 11.1.1 |
| Paloaltonetworks | Pan-Os | 11.1.2 |
| Paloaltonetworks | Pan-Os | 11.1.3 |
| Paloaltonetworks | Pan-Os | 11.1.4 |
| Paloaltonetworks | Pan-Os | 11.1.5 |
| Paloaltonetworks | Pan-Os | 11.1.6 |
| Paloaltonetworks | Pan-Os | 11.1.7 |
| Paloaltonetworks | Pan-Os | 11.1.8 |
| Paloaltonetworks | Pan-Os | 11.1.9 |
| Paloaltonetworks | Pan-Os | 11.1.10 |
| Paloaltonetworks | Pan-Os | 11.1.11 |
| Paloaltonetworks | Pan-Os | 11.1.12 |
| Paloaltonetworks | Pan-Os | 11.1.13 |
| Paloaltonetworks | Pan-Os | 11.1.14 |
| Paloaltonetworks | Pan-Os | 11.2.0 |
| Paloaltonetworks | Pan-Os | 11.2.1 |
| Paloaltonetworks | Pan-Os | 11.2.2 |
| Paloaltonetworks | Pan-Os | 11.2.3 |
| Paloaltonetworks | Pan-Os | 11.2.4 |
| Paloaltonetworks | Pan-Os | 11.2.5 |
| Paloaltonetworks | Pan-Os | 11.2.6 |
| Paloaltonetworks | Pan-Os | 11.2.7 |
| Paloaltonetworks | Pan-Os | 11.2.8 |
| Paloaltonetworks | Pan-Os | 11.2.9 |
| Paloaltonetworks | Pan-Os | 11.2.10 |
| Paloaltonetworks | Pan-Os | 11.2.11 |
| Paloaltonetworks | Pan-Os | 12.1.2 |
| Paloaltonetworks | Pan-Os | 12.1.3 |
| Paloaltonetworks | Pan-Os | 12.1.4 |
| Paloaltonetworks | Pan-Os | 12.1.5 |
Showing 50 of 52 affected configurations. See NVD for the full list.
References
- https://security.paloaltonetworks.com/CVE-2026-0300Mitigation, Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-967325.htmlThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-0300?
How severe is CVE-2026-0300?
How do I fix CVE-2026-0300?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-0294A privilege escalation (PE) vulnerability in the Palo Alto N…7.8
- CVE-2026-0295A race condition in the Palo Alto Networks GlobalProtect™ cl…7
- CVE-2026-0296Improper certificate validation vulnerabilities in Palo Alto…7.4
- CVE-2026-0297A buffer overflow vulnerability exists in the Palo Alto Netw…8.1
- CVE-2026-0298An improper input validation vulnerability exists in the Win…8.1
- CVE-2026-0299Local privilege escalation vulnerabilities in the Palo Alto …7.8
- CVE-2026-0301An information disclosure vulnerability in the URL Filtering…7.5
- CVE-2026-0302An OS command injection vulnerability in Palo Alto Networks …1.1
- CVE-2026-0303A code execution vulnerability in Palo Alto Networks Checkov…2.4
- CVE-2026-0304A privilege escalation vulnerability in Palo Alto Networks C…4.8
- CVE-2026-0305An information disclosure vulnerability in the Palo Alto Net…4.3
- CVE-2026-0306A vulnerability in the EndPoint Data Loss Prevention (DLP) e…5.8
Are you affected by CVE-2026-0300?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST