KEVIntel
PRO Back to KEVs
9.3
CVSS
Critical

CVE-2026-0300

PUBLISHED

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

1 day faster than CISA KEV

Exploited in the wild PoC available Remote Low complexity No user interaction
Vendor
Palo Alto Networks
Product
Cloud NGFW, PAN-OS, Prisma Access
Published
May 06, 2026
EPSS
4.9% · 90% pctl

Automate this intelligence with the Pro API

Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.

Learn about Pro

Description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

cisa edge

Weaknesses (CWE)

CVSS scores

CVSS v4.0 9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2026-06-01 13:26:25 UTC · CVE

Proof of concept available

Recorded 2026-05-21 20:39:21 UTC · GitHub

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CVE First 2026-06-01 13:26 UTC
CISA 2026-06-02 14:01 UTC

Recent mentions

CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal (Severity: CRITICAL)

Palo Alto Networks Security Advisories · May 28, 2026

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

lu4m575/CVE-2026-0300

github · Created 2026-05-21 20:39:21 UTC · 0 stars

CVE-2026-0300 PAN-OS 12.1, 11.2, 11.1, 10.2

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Added to KEVIntel

  • KEV confirmed by CISA