Paper/Archive/CVE-2026-0300

CVE-2026-0300

Palo Alto Networks Cloud NGFW — PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

KEV · due 9 May EPSS 42%public exploit SSVC act CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 98.7.987 × 2019.7 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Affected

ProductAffectedFixed inSource

Cloud NGFWsee advisoryAllCNA

PAN-OS12.1.0 – < 12.1.712.1.7CNA

PAN-OS11.2.0 – < 11.2.1211.2.12CNA

PAN-OS11.1.0 – < 11.1.1511.1.15CNA

PAN-OS10.2.0 – < 10.2.18-h610.2.18-h6CNA

Prisma Accesssee advisoryAllCNA

RUGGEDCOM APE1808all versions–siemens-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

palo_alto (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisorysecurity.paloaltonetworks.com/CVE-2026-0300 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300 refcert-portal.siemens.com/productcert/html/ssa-967325.html kevcisa.gov/known-exploited-vulnerabilities-catalog