CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , the same day the CVE record was published.
- How likely is exploitation in the next 30 days?
- 41.7%
EPSS score, percentile 98.7 of all scored records
- How severe?
- 9.3 Critical
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA deadline . Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Full text
- Which versions are affected?
Affected
- from 12.1.0 to before 12.1.7
- from 11.2.0 to before 11.2.12
- from 11.1.0 to before 11.1.15
Unaffected All; from 12.1.7; from 12.1.4-h5; from 11.2.12; from 11.2.10-h6; from 11.2.7-h13; and 5 more
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
CISA due date for this action: .
Solution (from the CVE record)
This issue will be fixed in upcoming releases of PAN-OS as captured in the table above. We strongly recommend that you secure access to your User-ID™ Authentication Portal following the instructions in the workarounds section below.
Workaround (from the CVE record)
Customers can mitigate the risk of this issue by taking either of the following actions: * Restrict User-ID™ Authentication Portal access to only trusted zones and in addition, disable Response Pages in the Interface Management Profile attached to every L3 interface in any zone where untrusted/internet traffic can ingress. Keep Response Pages enabled only on interfaces in trust/internal zones where legitimate users' browsers ingress. Refer to Step 6 of the following Live Community article (https://live.paloaltonetworks.com/t5/general-articles/why-it-s-essential-to-secure-your-management-interface/ta-p/1001286) and Knowledgebase article (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CqbiCAC) for steps to restrict access. * Disable User-ID™ Authentication Portal if not required. Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510019 from Applications and Threats content version 9097-10022. Decoder capabilities necessitate PAN-OS 11.1 or a later version for Threat ID support.
Advisories and patches
Linked from CISA's catalog entry
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | All |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | from 12.1.0 to before 12.1.7 |
| Unaffected | from 12.1.7 |
| Unaffected | from 12.1.4-h5 |
| Affected | from 11.2.0 to before 11.2.12 |
| Unaffected | from 11.2.12 |
| Unaffected | from 11.2.10-h6 |
| Unaffected | from 11.2.7-h13 |
| Unaffected | from 11.2.4-h17 |
| Affected | from 11.1.0 to before 11.1.15 |
| Unaffected | from 11.1.15 |
| Unaffected | from 11.1.13-h5 |
| Unaffected | from 11.1.10-h25 |
Versions not listed are: unaffected.
And 9 more version entries in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | All |
Versions not listed are: unaffected.
Versions the record lists as unaffected: 12.1.7, 12.1.4-h5, 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17, 11.1.15, 11.1.13-h5.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities (KEV) catalog on 6 May 2026.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 9 May 2026.
- The CVE record was published on 6 May 2026, the same day it was added to KEV.
- The CVE record carries a CVSS v4.0 base score of 9.3 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 41.7% (percentile 98.7), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-787: Out-of-bounds Write
Attack patterns (CAPEC)
- CAPEC-100: Overflow Buffers
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
More exploited Palo Alto Networks vulnerabilities
- CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
- CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability
- CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2024-3393: Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
- CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability