{"id":"CVE-2026-0300","kind":"vulnerability","aliases":["CVE-2026-0300"],"related":[],"title":"paloaltonetworks pan-os: A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto…","description":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented:  - Restrict User-ID Authentication Portal access to only trusted zones.  - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.","summary":"Palo Alto PAN-OS has an out-of-bounds write in the User-ID Authentication Portal (Captive Portal) service on PA-Series and VM-Series firewalls. An unauthenticated attacker can send crafted packets to execute arbitrary code as root on the firewall.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-05-06T00:00:00+00:00","products":[{"name":"Palo Alto Networks PAN-OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.0","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.1","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.2","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.3","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.10","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.11","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.13","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.15","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.16","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.17","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 10.2.18","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.0","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.1","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.2","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.3","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.5","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.6","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.7","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.8","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.9","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.10","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.11","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.12","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.13","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.1.14","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.0","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.1","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.2","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.3","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.4","ecosystem":"vendor"},{"name":"paloaltonetworks pan-os","fixed":[],"affected":"= 11.2.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","infrastructure","pa-series","palo-alto-networks","pan-os","vm-series"],"not_affected_if":["no-untrusted-zone-access","portal-disabled"],"how_to_check":"Check whether the User-ID Authentication Portal (Captive Portal) is enabled on the firewall and which zones can reach it.","fix":"Restrict User-ID Authentication Portal access to trusted zones only, or disable it if not required, then apply the PAN-OS patch Palo Alto designated for your version.","status":"open","published_at":"2026-05-06T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:37+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:38:37Z","model":"claude-haiku-5-5","output":{"fix":"Restrict User-ID Authentication Portal access to trusted zones only, or disable it if not required, then apply the PAN-OS patch Palo Alto designated for your version.\nunknown","reach":"network","summary":"Palo Alto PAN-OS has an out-of-bounds write in the User-ID Authentication Portal (Captive Portal) service on PA-Series and VM-Series firewalls. An unauthenticated attacker can send crafted packets to execute arbitrary code as root on the firewall.","category":"infrastructure","who_cares":["palo-alto-networks","pan-os","pa-series","vm-series","firewall"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker gains root code execution on the firewall.","analyst_note":"Find the affected and fixed PAN-OS versions and the Palo Alto advisory for CVE-2026-0300 (see the CISA KEV entry and Palo Alto security advisories) to fill in how_to_check and fix.","how_to_check":"Check whether the User-ID Authentication Portal (Captive Portal) is enabled on the firewall and which zones can reach it.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["portal-disabled","no-untrusted-zone-access"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2724,"output_tokens":484,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':323C '-0300':25A,28A '-2026':24A,27A '22':322C '5/13/2026':371C 'access':357C 'action':313C 'aka':16A,279C 'allow':285C 'alto':22A,30A,203B,212B,259C,373C 'appli':314C,388C 'applic':320C 'arbitrari':251B,291C 'attack':244B,288C 'authent':14A,228B,277C,355C,366C 'bod':321C 'bound':221B,269C 'buffer':6A 'captiv':17A,230B,280C 'cisa':311C 'cloud':326C 'code':252B,292C 'contain':264C 'craft':247B,309C 'cve':23A,26A 'design':390C 'disabl':362C 'discontinu':329C 'environ':386C 'execut':250B,290C 'exploit':195B 'firewal':196B,241B,257B,305C 'fix':344C 'follow':319C,346C 'guidanc':324C 'id':13A,227B,276C,354C,365C 'implement':350C 'infrastructur':197B 'instruct':318C 'mitig':315C,335C 'network':204B,260C 'networks':31A 'offici':343C 'os':4A,34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,86A,90A,94A,98A,102A,106A,110A,114A,118A,122A,126A,130A,134A,138A,142A,146A,150A,154A,158A,162A,166A,170A,174A,178A,182A,186A,190A,194A,207B,215B,263C 'out-of-bound':218B,266C 'overflow':7A 'pa':199B,235B,299C 'pa-seri':198B,234B,298C 'packet':248B,310C 'palo':21A,29A,202B,211B,258C,372C 'palo-alto-network':201B 'paloaltonetwork':1A 'paloaltonetworks':35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,87A,91A,95A,99A,103A,107A,111A,115A,119A,123A,127A,131A,135A,139A,143A,147A,151A,155A,159A,163A,167A,171A,175A,179A,183A,187A,191A 'pan':3A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A,85A,89A,93A,97A,101A,105A,109A,113A,117A,121A,125A,129A,133A,137A,141A,145A,149A,153A,157A,161A,165A,169A,173A,177A,181A,185A,189A,193A,206B,214B,262C 'pan-o':2A,205B,213B,261C 'pan-os':32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A,88A,92A,96A,100A,104A,108A,112A,116A,120A,124A,128A,132A,136A,140A,144A,148A,152A,156A,160A,164A,168A,172A,176A,180A,184A,188A,192A 'patch':379C,391C 'per':316C 'pleas':387C 'portal':15A,18A,229B,231B,278C,281C,356C,367C 'privileg':295C 'product':333C 'releas':341C,375C 'relev':383C 'requir':312C,370C 'restrict':351C 'root':254B,294C 'send':246B,307C 'seri':200B,210B,236B,240B,300C,304C 'servic':19A,232B,282C,327C 'special':308C 'trust':360C 'unauthent':243B,287C 'unavail':337C 'use':330C 'user':12A,226B,275C,353C,364C 'user-id':11A,225B,274C,352C,363C 'varieti':377C 'vendor':317C,340C 'vm':209B,239B,303C 'vm-seri':208B,238B,302C 'vulner':8A,271C 'workaround':347C 'write':222B,270C 'zone':361C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-06T00:00:00+00:00","kev":{"dateAdded":"2026-05-06","dueDate":"2026-05-09","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented:  - Restrict User-ID Authentication Portal access to only trusted zones.  - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-0300","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0300","severity":null,"published_at":"2026-05-06T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-0300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0300","severity":null,"published_at":"2026-05-06T19:16:35+00:00","modified_at":"2026-06-17T10:10:43+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}