CVE-2026-0300: Palo Alto PAN-OS User-ID Authentication Portal unauthenticated RCE, root-level
The short version: CVE-2026-0300 is a buffer-overflow flaw in the User-ID Authentication Portal (a.k.a. Captive Portal) of PAN-OS. An unauthenticated attacker who can reach the portal can send specially crafted packets to execute arbitrary code as root on PA-Series and VM-Series firewalls. It's confirmed exploited and in CISA's KEV catalog. Panorama, Cloud NGFW, and Prisma Access aren't affected. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Palo Alto) | 9.3 — Critical |
| EPSS | ~32.07% · 98.12th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2026-05-09 |
| Known exploited? | Yes — limited exploitation observed against exposed User-ID Authentication Portals |
| Vulnerability type | CWE-787 out-of-bounds write (buffer overflow) → unauthenticated remote code execution as root |
| Requires authenticated session? | No — pre-authentication |
| Affected | PAN-OS 10.2, 11.1, 11.2, and 12.1 branches with the User-ID Authentication Portal in use — see Palo Alto's advisory for exact fixed builds |
| Fixed in | See Palo Alto's advisory (e.g. 10.2.7-h34 · 11.1.4-h33 · 11.2.4-h17 · 12.1.4-h5 / 12.1.7, and later per branch) |
| Not affected | Panorama, Cloud NGFW, and Prisma Access |
What you need to know
The User-ID Authentication Portal (Captive Portal) is a PAN-OS feature that authenticates users to map them to traffic. CVE-2026-0300 is an out-of-bounds write: an unauthenticated attacker who can reach the portal sends specially crafted packets that overflow a buffer and yield arbitrary code execution with root privileges on the firewall.
This is about as bad as external exposure gets, and the target makes it worse:
- It's the firewall itself. Root on the perimeter device means control over the thing enforcing your controls.
- It's pre-authentication and network-reachable. Where the Authentication Portal is exposed, no credential and no chain are required.
- It's already being exploited. Palo Alto observed limited in-the-wild activity against portals reachable from untrusted IPs or the public internet, and CISA added it to KEV with a tight deadline.
How serious we see it
Critical — the 9.8 is not hyperbole here.
Unauthenticated, network-reachable, root-level code execution on a security appliance, confirmed exploited, is the definition of top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific PAN-OS builds with the Authentication Portal in use, common management platforms (Panorama, Prisma Access, Cloud NGFW) aren't affected, and restricting the portal to trusted internal IPs greatly reduces the risk even before you patch.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to the fixed PAN-OS build for your branch (see Palo Alto's advisory for exact hotfix versions).
- Restrict the Authentication Portal to trusted internal IPs. Per Palo Alto's best-practice guidance — this sharply cuts exposure if you can't patch immediately.
- Hunt. Follow Palo Alto's guidance to check for indicators of compromise; assume nothing given confirmed in-the-wild activity.
- If compromised, respond fully. Rebuild where warranted and rotate all credentials, keys, and certificates on the device.
- Confirm your exposure first. Verify whether you run an affected PAN-OS build with the User-ID Authentication Portal reachable.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected firewall? — from the outside in. Starting from little more than your domain, it discovers internet-facing PAN-OS portals, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top because it's in KEV.
That outside-in, continuous view is the whole point: when a firewall RCE breaks, the exposed appliance is already mapped, so you can go straight to patch-and-verify.