CVE-2026-0300: PAN-OS Buffer Overflow Vulnerability

CVE-2026-0300 Overview

CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication Portal (formerly Captive Portal) service of Palo Alto Networks PAN-OS software. An unauthenticated remote attacker can send specially crafted packets to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. The flaw is tracked under [CWE-787] (Out-of-bounds Write).

Prisma Access, Cloud NGFW, and Panorama appliances are not affected. The vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, and a public proof-of-concept is available.

Critical Impact

Unauthenticated network attackers can achieve root-level remote code execution on perimeter firewalls, enabling full device takeover, traffic interception, and lateral movement into internal networks.

Affected Products

• Palo Alto Networks PAN-OS software running the User-ID Authentication Portal (Captive Portal) service
• PA-Series hardware firewalls
• VM-Series virtual firewalls

Discovery Timeline

• 2026-05-06 - CVE-2026-0300 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-0300

Vulnerability Analysis

The vulnerability resides in the User-ID Authentication Portal service, the PAN-OS component responsible for authenticating users before granting network access through firewall policies. The service exposes a network-facing handler that processes authentication-related packets from clients on attached interfaces.

A buffer overflow ([CWE-787]) occurs when the service writes attacker-controlled data past the bounds of a fixed-size buffer while parsing crafted input. Because the Authentication Portal runs with root privileges on PAN-OS, successful memory corruption translates directly into arbitrary code execution at the highest privilege level. No authentication, user interaction, or prior access is required.

The vulnerability is confirmed exploited in the wild and is included in the CISA KEV catalog. A public proof-of-concept has been published to GitHub, increasing the likelihood of widespread weaponization.

Root Cause

The root cause is missing or insufficient bounds checking in the packet-parsing logic of the Authentication Portal service. Attacker-supplied length fields or payload data are written into a stack or heap buffer without validating that the destination can hold the input, leading to an out-of-bounds write and corruption of adjacent memory structures such as return addresses or function pointers.

Attack Vector

The attack vector is purely network-based. An attacker reachable on a network segment where the Authentication Portal is exposed sends specially crafted packets to the listening service. Successful exploitation yields code execution as root, allowing the attacker to disable logging, alter firewall rules, exfiltrate VPN credentials, and pivot into protected networks. Restricting the Authentication Portal to trusted internal IP addresses, as recommended by Palo Alto Networks best practice guidelines, significantly reduces exposure.

No verified exploit code is reproduced here. Refer to the Palo Alto Networks CVE Advisory and the public PoC repository for technical details.

Detection Methods for CVE-2026-0300

Indicators of Compromise

• Unexpected crashes, restarts, or core dumps of the User-ID Authentication Portal process on PA-Series or VM-Series firewalls.
• Outbound connections from the firewall management or data plane to unknown external IP addresses, particularly shortly after Authentication Portal traffic.
• New or modified administrative accounts, configuration commits, or scheduled jobs on PAN-OS that cannot be attributed to legitimate change tickets.
• Anomalous shell or CLI activity originating from the Authentication Portal service context.

Detection Strategies

• Inspect Authentication Portal request payloads at network sensors for oversized fields, malformed authentication packets, or signatures matching the published PoC.
• Correlate firewall system logs (crashinfo, daemon restarts) with inbound traffic to TCP/UDP ports used by the Captive Portal to identify exploitation attempts.
• Hunt across endpoint and network telemetry for post-exploitation behaviors such as configuration exfiltration, credential dumping from firewall stores, or tunneling tools deployed from a compromised firewall.

Monitoring Recommendations

• Forward PAN-OS system, configuration, and threat logs to a central SIEM or data lake and alert on Authentication Portal daemon failures.
• Monitor north-south traffic for unexpected sessions sourced from firewall interfaces, which can indicate a compromised device acting as a beachhead.
• Track the CISA KEV catalog entry and vendor advisory for updated indicators and patch availability.

How to Mitigate CVE-2026-0300

Immediate Actions Required

• Apply the security update referenced in the Palo Alto Networks CVE Advisory to all PA-Series and VM-Series firewalls running the Authentication Portal.
• Restrict access to the User-ID Authentication Portal to trusted internal IP addresses only, in line with Palo Alto Networks best practice guidelines.
• Treat any unpatched, internet-exposed PAN-OS device as potentially compromised and initiate incident response procedures, including credential rotation and configuration review.
• Comply with CISA KEV remediation deadlines for federal and regulated environments.

Patch Information

Palo Alto Networks has published fixed PAN-OS versions in its security advisory. Identify the running PAN-OS version on each device and upgrade to a vendor-listed fixed release. Prisma Access, Cloud NGFW, and Panorama do not require patching for this issue. Validate the upgrade by confirming the Authentication Portal service version and re-running vulnerability scans after deployment.

Workarounds

• Disable the User-ID Authentication Portal (Captive Portal) feature on affected firewalls if it is not required for operations.
• Apply firewall policies or external ACLs that limit inbound access to the Authentication Portal interface to a minimal set of trusted internal subnets.
• Place compensating controls such as IPS signatures and zone protection profiles in front of the Authentication Portal until the patch is deployed.

# Example: restrict Authentication Portal access via a security policy
# (illustrative PAN-OS CLI - validate against your environment)
configure
set rulebase security rules restrict-captive-portal \
    from untrust to untrust \
    source any destination <captive-portal-ip> \
    application panos-global-protect \
    service application-default \
    source-user any \
    action deny
commit