Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-0300

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

Only PA-Series and VM-Series firewalls using the User-ID Authentication Portal with response pages on untrusted-facing interfaces are affected. Fixed in PAN-OS 12.1.7 and later fixed releases.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: active
  • Automatable: yes
  • Technical impact: total

Summary

The software affected is Palo Alto Networks PAN-OS running on PA-Series and VM-Series firewalls, specifically its User-ID Authentication Portal (Captive Portal) service. An unauthenticated attacker could exploit this flaw by sending specially crafted network packets to run their own code with the highest administrative (root) privileges on the firewall.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Timeline

  1. CISA SSVC assessment

    Exploitation: active · Automatable: yes · Technical impact: total

  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CVE published
  4. CISA remediation deadline

    Due date for US federal agencies to patch

  5. Record last updated
  6. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Palo Alto Networks Cloud NGFW

    Version range not reported

  • Palo Alto Networks PAN-OS

    From 12.1.0 · fixed in 12.1.7; From 11.2.0 · fixed in 11.2.12; From 11.1.0 · fixed in 11.1.15; From 10.2.0 · fixed in 10.2.18-h6

  • Palo Alto Networks Prisma Access

    Version range not reported

References 1

security.paloaltonetworks.com

FAQ

Questions about CVE-2026-0300

What does this mean?

A buffer overflow in the User-ID Authentication Portal can be triggered by an unauthenticated user. The overflow can run arbitrary code with root privileges on the firewall.Source: security.paloaltonetworks.com

Am I affected, and how do I check?

Affected are PA-Series and VM-Series firewalls running PAN-OS 10.2.0 before 10.2.18-h6, 11.1.0 before 11.1.15, 11.2.0 before 11.2.12, or 12.1.0 before 12.1.7, with the User-ID Authentication Portal enabled. The setup also needs an interface management profile with response page enabled on an L3 interface in a zone where untrusted traffic can enter. To check, review the Authentication Portal Settings and the interface management profiles on the firewall, and confirm the PAN-OS version. Cloud NGFW and Prisma Access are not listed as affected products.Source: security.paloaltonetworks.com

What should I do about it?

Upgrade to PAN-OS 12.1.7 or later, or to the fixed release for the relevant branch: 10.2.18-h6, 11.1.15, or 11.2.12. If the portal is not needed, disabling it removes this exposure.Source: security.paloaltonetworks.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-06, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data