Which versions of PAN-OS are affected by CVE-2026-0300?

CVE-2026-0300 is a critical remote code execution vulnerability in Palo Alto Networks PAN-OS Captive Portal affecting PA-Series and VM-Series firewalls, with confirmed active exploitation in the wild…. A patch is available.

Is there a public PoC exploit available for CVE-2026-0300?

Yes, a public proof-of-concept exploit is available for CVE-2026-0300. Prioritise patching immediately. EPSS: 14.9%.

How to fix or mitigate CVE-2026-0300?

WITHIN 24 HOURS: (1) Identify all PA-Series and VM-Series firewalls in your environment running PAN-OS versions vulnerable to CVE-2026-0300-contact Palo Alto Networks for affected version list if not yet published; (2) restrict network access to the User-ID Captive Portal to trusted internal management networks only via firewall rules or air-gapping; (3) enable enhanced logging and alerting on portal authentication attempts. WITHIN 7 DAYS: (1) review CISA KEV advisories and Palo Alto Networks security bulletins for confirmed vulnerable versions; (2) test failover/backup appliances if portal restriction is not operationally feasible; (3) establish incident response procedures for potential compromise detection. WITHIN 30 DAYS: apply vendor-released patch immediately upon availability; if no patch window is available, escalate to executive risk review for extended mitigation acceptance or appliance replacement.

PAN-OS CVE-2026-0300

Q: What is the CVSS score of CVE-2026-0300?

CVE-2026-0300 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red. EPSS exploitation probability: 14.9%.

EUVD-2026-27879 CRITICAL

Out-of-bounds Write (CWE-787)

2026-05-06 palo_alto

Paloalto Memory Corruption Buffer Overflow RCE

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 20:02 EUVD

Analysis Generated

May 06, 2026 - 19:46 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

9.3 (CRITICAL)

Added to CISA KEV

May 06, 2026 - 19:18 CISA

CVE Published

May 06, 2026 - 18:57 nvd

CRITICAL 9.3

DescriptionCVE.org

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses.

Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Articles & Coverage 3

thecyberexpress.com CERT-In Mandates 12-Hour Patch Window for Critical Vulnerabilities as AI Accelerates Exploit Development (CVE-2026-0300) May 27, 2026 sentinelone.com The Good, the Bad and the Ugly in Cybersecurity – Week 19 May 08, 2026 POC POC: CVE-2026-0300-POC May 07, 2026

AnalysisAI

Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls via specially crafted packets. CISA KEV confirms active exploitation in the wild with publicly available exploit code. EPSS risk assessment is not provided, but the vulnerability achieves maximum impact with minimal attack complexity (CVSS 9.3, AV:N/AC:L/PR:N), making this a critical priority for immediate remediation. The attack surface is significantly reduced when access to the portal is restricted to trusted internal networks per vendor best practices.

Technical ContextAI

This vulnerability exploits a classic buffer overflow (CWE-787: Out-of-bounds Write) in the User-ID Authentication Portal service, also known as the Captive Portal, which handles user authentication before granting network access. The affected component is part of PAN-OS, the operating system running on Palo Alto Networks PA-Series hardware firewalls and VM-Series virtual firewalls. Buffer overflows occur when input validation fails to properly bound memory writes, allowing attackers to overwrite adjacent memory regions including return addresses and function pointers. In this case, the service processes network packets without adequate bounds checking, enabling attackers to inject malicious payloads that execute with root privileges-the highest privilege level on the firewall. The CPE data identifies pan-os:*:*:*:*:*:*:*:* as affected, while explicitly excluding Prisma Access, Cloud NGFW, and Panorama appliances from the vulnerability scope despite their presence in some CPE listings.

RemediationAI

Apply vendor-released security patches immediately per the advisory at https://security.paloaltonetworks.com/CVE-2026-0300, which specifies patched PAN-OS versions for each major release branch. Given active exploitation confirmed by CISA KEV, this patch should be treated as emergency maintenance requiring expedited change control processes. As an immediate compensating control while patches are being deployed, restrict access to the User-ID Authentication Portal to only trusted internal IP addresses following the best practice guidelines at https://knowledgebase.paloaltonetworks.com/KCSArticleDetail. This can be implemented via interface management profiles and security policies to create IP allowlists for the captive portal service. Trade-off: restricting access may temporarily impact legitimate users outside the trusted IP ranges who require authentication portal access, requiring coordination with network operations teams to identify and whitelist all legitimate source networks. For internet-facing deployments where the portal must remain accessible, consider placing additional network controls (IPS signatures, web application firewall rules) in front of affected devices until patching is complete, though these provide incomplete protection against a memory corruption vulnerability. Do not rely solely on network controls as primary mitigation-patch deployment remains the only complete remediation.