PAN-OS Remote Code Execution Vulnerability (CVE-2026-0300)

A new critical Remote Code Execution Vulnerability (CVE-2026-0300) was recently identified in PAN-OS with the User-ID™ Authentication Portal (aka Captive Portal) service enabled which allows an unauthenticated remote attacker to execute arbitrary code with root privileges.  The vulnerability is actively exploited in the wild.  Palo Alto Networks has released the Security Advisory and strongly recommends customers to secure the access to their User-ID™ Authentication Portal IMMEDIATELY.

Vulnerability

• PAN-OS Remote Code Execution Vulnerability (CVE-2026-0300)

Severity Level

• Critical

Affected Products

• PA-Series and VM-Series firewalls with
  • PAN-OS 12.1
    • < 12.1.4-h5
    • < 12.1.7
  • PAN-OS 11.2
    • < 11.2.4-h17
    • < 11.2.7-h13
    • < 11.2.10-h6
    • < 11.2.12
  • PAN-OS 11.1
    • < 11.1.4-h33
    • < 11.1.6-h32
    • < 11.1.7-h6
    • < 11.1.10-h25
    • < 11.1.13-h5
    • < 11.1.15
  • PAN-OS 10.2
    • < 10.2.7-h34
    • < 10.2.10-h36
    • < 10.2.13-h21
    • < 10.2.16-h7
    • < 10.2.18-h6

Remediation

• Apply the fix in upcoming releases for above affected PAN-OS version ASAP when available.
• Workaround: Secure access to your User-ID™ Authentication Portal by taking either of the following actions:
  • Restrict User-ID™ Authentication Portal access to only trusted zones. Refer to Step 6 of Live Community article and Knowledgebase article for steps to restrict access.
  • Disable User-ID™ Authentication Portal if not required.
• Threat Prevention Signature will be made available to all customers running PAN-OS 11.1 and above by 05/05.

Reference

• Palo Alto Networks: CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
• Palo Alto Networks: How to Configure Captive Portal – Knowledge Base
• Palo Alto Networks: Why It’s Essential to Secure Your Management Interface | Palo Alto Networks
• HKCERT: Palo Alto PAN-OS Remote Code Execution Vulnerability
• Tenable: CVE-2026-0300
• Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution

Published on: 6 May 2026