CVE-2026-0300: Palo Alto Networks PAN-OS

What is CVE-2026-0300?

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

CVSS9.8 NVD 3.1

SeverityCRITICAL

Exploitation In the wild In CISA KEV

EPSS32% · P98

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD published2026-05-06

NVD last modified2026-06-17

Timeline

2026-05-06Published to the U.S. National Vulnerability Database (NVD)
2026-05-06Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-05-07First covered in a defend.network daily briefing
2026-05-09CISA federal remediation deadline (BOD 22-01)
2026-06-17NVD record last updated

CISA Known Exploited Vulnerability

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Added to KEV2026-05-06

Federal patch deadline2026-05-09

Known ransomware useUnknown

Affected product

Palo Alto Networks PAN-OS

NVD also lists CPE entries for: Paloaltonetworks Pan-Os, Paloaltonetworks Pa-1410, Paloaltonetworks Pa-1420, Paloaltonetworks Pa-3410, Paloaltonetworks Pa-3420

Remediation Steps

Obtain and review security advisory from vendor or CISA
Prioritize patching based on exposed asset inventory and business criticality
Verify all systems are updated and validated
Monitor for related indicators of compromise
Document patching timeline and completion status

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of May 2026 (May 11 – 17)
Palo Alto & Ivanti EPMM RCE exploited; PCPJack worm hits cloud (2026-05-08)
vm2, Palo Alto, DAEMON Tools exploited; Iran APT false-flag operations (2026-05-07)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.