CVE-2026-0300
Buffer Overflow in Palo Alto PAN-OS User-ID Authentication Portal
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: Palo Alto Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| palo_alto_networks | pan-os | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow in the User-ID™ Authentication Portal (also known as Captive Portal) service of Palo Alto Networks PAN-OS software. It allows an unauthenticated attacker to send specially crafted packets to the affected firewalls, which can lead to the execution of arbitrary code with root privileges.
The affected devices are PA-Series and VM-Series firewalls. The vulnerability does not impact Prisma Access, Cloud NGFW, or Panorama appliances.
The risk can be greatly reduced by securing access to the User-ID™ Authentication Portal according to best practice guidelines, such as restricting access to trusted internal IP addresses.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary code with root privileges on the affected firewall devices. This means the attacker could potentially take full control of the firewall, bypass security controls, disrupt network traffic, or use the firewall as a foothold to attack other parts of the network.
Because the attacker does not need to be authenticated, the attack can be launched remotely by sending specially crafted packets.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, it is recommended to secure access to the User-ID™ Authentication Portal by restricting access to only trusted internal IP addresses as per best practice guidelines.
This reduces the risk of exploitation by limiting exposure of the vulnerable service.