Vulnpedia
← All CVEs

CVE-2026-0300

CRITICAL 9.3 KNOWN EXPLOITED ALL-YEARS

Published 2026-05-06 · Last modified 2026-10-15 · palo_alto · NVD: Analyzed

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-05-06. Patch or mitigate now.

Exploitation likelihood

41.7%chance of exploitation in 30 days · 99th percentile

● In CISA KEV (2026-05-06)○ Catalogued PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

9.3CVSS 4.0 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Palo Alto Networks Siemens Paloaltonetworks

Products Cloud Ngfw Pan Os Prisma Access Ruggedcom Ape1808 Pa 1410 Pa 1420 Pa 3410 Pa 3420 Pa 3430 Pa 3440 Pa 410 Pa 410r Pa 410r 5g Pa 415 Pa 415 5g Pa 440 Pa 445 Pa 450 Pa 450r Pa 450r 5g Pa 455 Pa 455 5g Pa 455r 5g Pa 460 Pa 501 Pa 505 Pa 510 Pa 520 Pa 540 Pa 5410 Pa 5420 Pa 5430 Pa 5440 Pa 5445 Pa 545 Poe Pa 5450 Pa 550 Pa 5540 Pa 555 Poe Pa 5550

Weakness (CWE)

  • CWE-787: : Out-of-bounds Write

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red

References and research data (JSON)

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

10 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

  • VulnCheck KEV · 2026-05-05T00:00:00Z

    Source guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

    Source ransomware assessment: Known

    VulnCheck KEV · CVE-2026-0300 · Updated 2026-05-05T00:00:00Z
  • VulnCheck KEV · 2026-05-05T00:00:00ZVulnCheck KEV · CVE-2026-0300
  • VulnCheck KEV · 2026-05-06T00:00:00ZVulnCheck KEV · CVE-2026-0300
    VulnCheck KEV · CVE-2026-0300
    VulnCheck KEV · CVE-2026-0300
  • VulnCheck KEV · 2026-05-27T00:00:00ZVulnCheck KEV · CVE-2026-0300
  • VulnCheck KEV · 2026-06-08T00:00:00ZVulnCheck KEV · CVE-2026-0300
  • VulnCheck KEV · 2026-07-27T00:00:00ZVulnCheck KEV · CVE-2026-0300
  • VulnCheck KEV · 2026-08-14T00:00:00ZVulnCheck KEV · CVE-2026-0300
  • VulnCheck KEV · 2026-09-08T00:00:00ZVulnCheck KEV · CVE-2026-0300

Known Affected Software Configurations

VendorProductVersion range
PaloaltonetworksPan Os10.2.0
PaloaltonetworksPan Os10.2.1
PaloaltonetworksPan Os10.2.2
PaloaltonetworksPan Os10.2.3
PaloaltonetworksPan Os10.2.4
PaloaltonetworksPan Os10.2.5
PaloaltonetworksPan Os10.2.6
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.7
PaloaltonetworksPan Os10.2.8
PaloaltonetworksPan Os10.2.9
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.10
PaloaltonetworksPan Os10.2.11
PaloaltonetworksPan Os10.2.12
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.13
PaloaltonetworksPan Os10.2.14
PaloaltonetworksPan Os10.2.15
PaloaltonetworksPan Os10.2.16
PaloaltonetworksPan Os10.2.16
PaloaltonetworksPan Os10.2.16
PaloaltonetworksPan Os10.2.16
PaloaltonetworksPan Os10.2.17
PaloaltonetworksPan Os10.2.18
PaloaltonetworksPan Os10.2.18
PaloaltonetworksPan Os10.2.18
PaloaltonetworksPan Os11.1.0
PaloaltonetworksPan Os11.1.1
PaloaltonetworksPan Os11.1.2
PaloaltonetworksPan Os11.1.3
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.4
PaloaltonetworksPan Os11.1.5
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.6
PaloaltonetworksPan Os11.1.7
PaloaltonetworksPan Os11.1.7
PaloaltonetworksPan Os11.1.7
PaloaltonetworksPan Os11.1.7
PaloaltonetworksPan Os11.1.8
PaloaltonetworksPan Os11.1.9
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.10
PaloaltonetworksPan Os11.1.11
PaloaltonetworksPan Os11.1.12
PaloaltonetworksPan Os11.1.13
PaloaltonetworksPan Os11.1.13
PaloaltonetworksPan Os11.1.13
PaloaltonetworksPan Os11.1.13
PaloaltonetworksPan Os11.1.14
PaloaltonetworksPan Os11.2.0
PaloaltonetworksPan Os11.2.1
PaloaltonetworksPan Os11.2.2
PaloaltonetworksPan Os11.2.3

Showing 120 of 163 configuration entries. Full list on NVD.

All CVSS metrics

  • CRITICAL 9.3 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red
  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red
  • CRITICAL 9.3 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red
  • CRITICAL 9.8 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS