Palo Alto PAN‑OS CVE‑2026‑0300 exploited via User‑ID portal

Executive Summary

CVE‑2026‑0300 is a critical PAN‑OS flaw allowing unauthenticated remote code execution as root via the User‑ID Authentication Portal service. The vulnerability is confirmed as actively exploited in the wild, with attacks focusing on portals exposed to untrusted networks or the public internet.

Key Details

Affected Platform

Palo Alto Networks

Attack Surface

Network accessible, unauthenticated

Recommended Action

Affected Environment

PA‑Series and VM‑Series firewalls running affected PAN‑OS versions with the User‑ID Authentication (Captive) Portal enabled and network‑reachable. Cloud NGFW and Prisma Access are not affected. Systems with the portal disabled or restricted to trusted internal zones have significantly reduced exposure.

Operational Impact

Successful compromise provides attackers with root‑level control of the firewall, enabling full manipulation of security policies and traffic. This could undermine monitoring, bypass controls, and facilitate further lateral movement or data exfiltration through trusted network paths.

Technical Root Cause

A buffer overflow (CWE‑787) in the portal’s request processing logic allows memory corruption when handling specifically crafted network requests. This condition enables arbitrary code execution with root privileges on affected firewalls without requiring user interaction or prior authentication.

Recommended Mitigation

Plan and schedule deployment of vendor PAN‑OS fixes as they become available for your specific versions starting 13 May 2026.
Immediately restrict portal access to trusted internal IP ranges or disable the User‑ID Authentication Portal entirely if not business‑critical.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore MDR for Palo Alto

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Refer to Palo Alto Networks’ CVE‑2026‑0300 advisory for full version‑specific patch details and authoritative guidance. Consult Palo Alto documentation on Captive Portal configuration and the published knowledge base article for additional mitigation context.