Palo Alto Networks has issued an urgent security advisory concerning a critical vulnerability affecting its PAN-OS software.
Tracked as CVE-2026-0300, this high-severity security flaw carries a CVSS 4.0 base score of 9.3 and is currently experiencing limited active exploitation in the wild.
The vulnerability allows unauthenticated, remote attackers to execute arbitrary code with full root privileges on affected PA-Series and VM-Series firewalls, creating a severe operational risk for enterprises worldwide.
The security flaw originates from a buffer overflow vulnerability in the User-ID Authentication Portal, commonly referred to as the Captive Portal service.
Classified as an out-of-bounds write weakness (CWE-787), the vulnerability allows threat actors to completely compromise the firewall appliance by transmitting specially crafted network packets to the targeted service.
Because the attack vector is network-based and requires zero user interaction or prior administrative privileges, the overall exploitation complexity remains alarmingly low.
This makes the flaw highly automatable, allowing threat actors to scan for and compromise vulnerable internet-facing endpoints rapidly.
Security researchers have confirmed limited exploitation campaigns actively targeting Palo Alto Networks firewalls where the User-ID Authentication Portal remains exposed to untrusted IP addresses or the broader public internet.
Organizations that have failed to implement standard network segregation practices are currently at the highest risk of immediate compromise.
The vulnerability was discovered in production, highlighting the ongoing threat posed by sophisticated network-scanning and exploitation techniques.
Affected PAN-OS Versions
The buffer overflow vulnerability affects multiple generations of PAN-OS on PA-Series and VM-Series appliances configured to use the authentication portal.
The vulnerable software branches include specific versions of PAN-OS 12.1, 11.2, 11.1, and 10.2. Administrators should review their deployment versions carefully to determine their exact exposure level.
Palo Alto Networks has officially confirmed that its cloud-centric and management solutions, including Prisma Access, Cloud NGFW, and Panorama appliances, are inherently immune to this specific vulnerability and require no immediate remediation.
Palo Alto Networks is actively engineering official firmware updates to permanently resolve the vulnerability.
The patched software releases are scheduled to become available in a staggered rollout between May 13 and May 28, 2026, depending on the specific PAN-OS version branch in use.
While waiting for these critical software updates, system administrators are strongly urged to implement immediate workarounds.
The most effective temporary mitigation strategy is to restrict access to the User-ID Authentication Portal to trusted internal network zones only.
Alternatively, organizations can disable the Authentication Portal entirely if it is not strictly required for daily operations.
Additionally, administrators managing environments running PAN-OS 11.1 or later can deploy the newly released Threat Prevention Signature to actively monitor and block malicious network traffic targeting this buffer overflow weakness.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…