CVE-2026-0300

Details

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses.

Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Affected Packages

PAN-OS

PANOS

Fixed in:

10.2.18-h610.2.7-h3410.2.10-h3610.2.13-h2110.2.16-h711.1.1511.1.4-h3311.1.6-h3211.1.7-h611.1.10-h25+7 more

References

WEB

https://cert-portal.siemens.com/productcert/html/ssa-967325.html

ADVISORY

https://security.paloaltonetworks.com/CVE-2026-0300

WEB

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-0300