InfoSecBulletin Cybersecurity for mankind
A critical flaw in Palo Alto Networks PAN-OS is putting business firewalls at risk. It lets unverified attackers run any code they want with full control.
Tracked as CVE-2026-0300 is a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software which allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
The vulnerability stems from a buffer overflow issue (CWE-787) in the authentication portal component.
Affected Versions
The security flaw affects many versions of PAN-OS, such as 10.2, 11.1, 11.2, and 12.1 before some updates were fixed. But, Prisma Access, Cloud NGFW, and Panorama devices are secure.
However, exploitation is only possible when certain configurations are in place:
- The User-ID Authentication Portal is on (in either transparent or redirect mode).
- A management interface profile with “response pages” on is linked to an interface that faces untrusted or internet areas.
This mix makes it possible for attackers to reach the system and start a buffer overflow from afar.
Patches and Mitigation
Palo Alto Networks has launched updates for the affected versions, with more fixes coming by May 28, 2026. Companies should upgrade right away to the fixed versions like:
PAN-OS 12.1.4-h5 or 12.1.7+
PAN-OS 11.2.4-h17, 11.2.7-h13, or 11.2.12+
PAN-OS 11.1.4-h33, 11.1.6-h32, or 11.1.15+
PAN-OS 10.2.7-h34 or 10.2.18-h6+
For environments where patching is delayed, Palo Alto recommends the following mitigations:
Restrict User-ID Authentication Portal access to trusted internal networks only.
Disable response pages on interfaces exposed to untrusted traffic.
Completely disable the authentication portal if not required.
Enable Threat ID 510019 (Applications and Threats version 9097-10022) for detection and blocking.
