Live › vulnerability › CVE-2026-0300
Go to dashboardPalo Alto PAN-OS has an out-of-bounds write in the User-ID Authentication Portal (Captive Portal) service on PA-Series and VM-Series firewalls. An unauthenticated attacker can send crafted packets to execute arbitrary code as root on the firewall.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Palo Alto Networks PAN-OS | vendor | – | – |
| paloaltonetworks pan-os | vendor | = 10.2.0 | – |
| paloaltonetworks pan-os | vendor | = 10.2.1 | – |
| paloaltonetworks pan-os | vendor | = 10.2.2 | – |
| paloaltonetworks pan-os | vendor | = 10.2.3 | – |
| paloaltonetworks pan-os | vendor | = 10.2.4 | – |
| paloaltonetworks pan-os | vendor | = 10.2.5 | – |
| paloaltonetworks pan-os | vendor | = 10.2.6 | – |
| paloaltonetworks pan-os | vendor | = 10.2.7 | – |
| paloaltonetworks pan-os | vendor | = 10.2.8 | – |
| paloaltonetworks pan-os | vendor | = 10.2.9 | – |
| paloaltonetworks pan-os | vendor | = 10.2.10 | – |
| paloaltonetworks pan-os | vendor | = 10.2.11 | – |
| paloaltonetworks pan-os | vendor | = 10.2.12 | – |
| paloaltonetworks pan-os | vendor | = 10.2.13 | – |
| paloaltonetworks pan-os | vendor | = 10.2.14 | – |
| paloaltonetworks pan-os | vendor | = 10.2.15 | – |
| paloaltonetworks pan-os | vendor | = 10.2.16 | – |
| paloaltonetworks pan-os | vendor | = 10.2.17 | – |
| paloaltonetworks pan-os | vendor | = 10.2.18 | – |
| paloaltonetworks pan-os | vendor | = 11.1.0 | – |
| paloaltonetworks pan-os | vendor | = 11.1.1 | – |
| paloaltonetworks pan-os | vendor | = 11.1.2 | – |
| paloaltonetworks pan-os | vendor | = 11.1.3 | – |
| paloaltonetworks pan-os | vendor | = 11.1.4 | – |
| paloaltonetworks pan-os | vendor | = 11.1.5 | – |
| paloaltonetworks pan-os | vendor | = 11.1.6 | – |
| paloaltonetworks pan-os | vendor | = 11.1.7 | – |
| paloaltonetworks pan-os | vendor | = 11.1.8 | – |
| paloaltonetworks pan-os | vendor | = 11.1.9 | – |
| paloaltonetworks pan-os | vendor | = 11.1.10 | – |
| paloaltonetworks pan-os | vendor | = 11.1.11 | – |
| paloaltonetworks pan-os | vendor | = 11.1.12 | – |
| paloaltonetworks pan-os | vendor | = 11.1.13 | – |
| paloaltonetworks pan-os | vendor | = 11.1.14 | – |
| paloaltonetworks pan-os | vendor | = 11.2.0 | – |
| paloaltonetworks pan-os | vendor | = 11.2.1 | – |
| paloaltonetworks pan-os | vendor | = 11.2.2 | – |
| paloaltonetworks pan-os | vendor | = 11.2.3 | – |
| paloaltonetworks pan-os | vendor | = 11.2.4 | – |
| paloaltonetworks pan-os | vendor | = 11.2.5 | – |
Check whether the User-ID Authentication Portal (Captive Portal) is enabled on the firewall and which zones can reach it.
Restrict User-ID Authentication Portal access to trusted zones only, or disable it if not required, then apply the PAN-OS patch Palo Alto designated for your version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-0300")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.