2026-006: Critical Vulnerability in PAN-OS
Palo Alto Networks PAN-OS User-ID Authentication Portal flaw allows unauthenticated root RCE; limited exploitation observed and patches still pending.
Palo Alto Networks disclosed CVE-2026-0300 (CVSS 9.3), a buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) that enables unauthenticated arbitrary code execution with root privileges on PA-Series and VM-Series firewalls. Only appliances configured to use the Authentication Portal are affected. Palo Alto observed limited exploitation; at publication patches were not yet available, so restricting portal access to trusted zones or disabling it was recommended as mitigation.
- Unauthenticated root RCE via crafted packets to the Captive Portal
- Only PA-Series and VM-Series firewalls with User-ID Authentication Portal affected
- Palo Alto observed limited exploitation of the flaw
- Mitigate by restricting portal access to trusted zones or disabling it
- CVEs
- CVE-2026-0300
- Vendors
- Palo Alto NetworksCERT-EU
- Organizations
- Palo Alto NetworksCERT-EU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0300 | Unauthenticated Out-of-bounds Write RCE in Palo Alto Networks PAN-OS | 9.3 | 42% | KEV | KEV |
From the original article
1 min read at cert.europa.eu
On 6 May 2026, Palo Alto published a security advisory addressing a critical vulnerability affecting PAN-OS. This vulnerability allows an unauthenticated attacker to execute arbitrary code with root privileges. Palo Alto observed limited exploitation of this vulnerability.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.