PAN-OS CVE-2026-0300

No special conditions required for exploitation against default configurations exposing the User-ID Authentication Portal (Captive Portal) to network access. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with low attack complexity. However, exploitation risk is substantially limited when the Authentication Portal is configured per Palo Alto Networks best practices to restrict access exclusively to trusted internal IP addresses via interface management profiles-in this deployment model, only attackers with network access from whitelisted source IPs can reach the vulnerable service. Additional limiting factors: vulnerability is specific to PA-Series and VM-Series firewalls running PAN-OS with the User-ID Authentication Portal feature; Panorama, Prisma Access, and Cloud NGFW platforms are not vulnerable. Organizations that have disabled the Captive Portal feature entirely or never deployed it are not exposed. The vulnerability requires network connectivity to the portal service interface, so firewalls where this service is bound only to isolated management networks face reduced external attack surface.

This vulnerability represents maximum real-world risk across all assessment frameworks. The CVSS 4.0 vector shows network-accessible exploitation (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), achieving high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with subsequent system scope impact (SC:L/SI:L). The Exploit Maturity indicator (E:A) confirms active exploitation, validated by CISA KEV inclusion indicating threat actors are actively weaponizing this vulnerability in real-world attacks. Public exploit code availability lowers the barrier to entry for less sophisticated attackers. The SSVC framework yields a critical decision: exploitation is confirmed (not just POC), the vulnerability is highly automatable given the unauthenticated network vector, and technical impact is total system compromise with root access. The only mitigating factor is the deployment-specific risk reduction when the Authentication Portal is restricted to trusted internal networks-however, organizations with internet-facing or broad internal access to this service face immediate compromise risk. The CVSS 9.3 score accurately reflects the severity, and unlike many high-CVSS vulnerabilities, this one combines theoretical severity with confirmed active exploitation, making it an absolute remediation priority. No conflicting signals exist between assessment frameworks-all indicators align on critical risk.

An unauthenticated remote attacker scans for exposed Palo Alto Networks firewalls with accessible User-ID Authentication Portal services (typically TCP ports 80/443). Using publicly available exploit code, the attacker sends specially crafted packets containing oversized input fields that trigger the buffer overflow in the portal's packet processing routine. The overflow overwrites memory to redirect code execution, allowing the attacker to inject and execute a malicious payload with root privileges, achieving complete control of the firewall including access to all network traffic, VPN credentials, security policies, and the ability to pivot into protected network segments.