PT-2026-37340 · Palo Alto Networks · Pa-Series+2

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-0300

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions PAN-OS (affected versions not specified)

Description A buffer overflow exists in the User-ID Authentication Portal (also known as Captive Portal) service of PAN-OS software affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated attackers to execute arbitrary code with full root privileges without requiring credentials, user interaction, or special conditions. This issue is being actively exploited in the wild.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the User-ID Authentication Portal to minimize the risk of exploitation.

DoS

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-0300

Affected Products

Pa-Series

Pan-Os

Vm Series

References · 91

• https://nvd.nist.gov/vuln/detail/CVE-2026-0300 · Security Note
• https://twitter.com/aviatrixtrc/status/2052075564933030359 · Twitter Post
• https://twitter.com/CRADecoded/status/2052018108953452933 · Twitter Post
• https://twitter.com/AlphonseIndus/status/2052067543032926336 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1t5dxtm/critical_buffer_overflow_in_palo_alto_networks · Reddit Post
• https://twitter.com/socradar/status/2051990373980160067 · Twitter Post
• https://twitter.com/rapid7/status/2052024649827922377 · Twitter Post
• https://twitter.com/TheHackersNews/status/2051909370213179717 · Twitter Post
• https://security.paloaltonetworks.com/CVE-2026-0300 · Vendor Advisory, Security Note, Reddit Post
• https://twitter.com/Digital_Warfare/status/2051963104024465740 · Twitter Post
• https://twitter.com/DopeDrew/status/2052027115709534459 · Twitter Post
• https://twitter.com/rxerium/status/2051938827942412502 · Twitter Post
• https://twitter.com/h4x0r_dz/status/2051921004348252353 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1t5cdfu/cve20260300_palo_alto_panos_zeroday_enables_root · Reddit Post
• https://twitter.com/markovichio/status/2052040690645844391 · Twitter Post