InfoSecBulletin Cybersecurity for mankind
A critical flaw in Palo Alto Networks PAN-OS is putting business firewalls at risk. It lets unverified attackers run any code they want with full control.
Tracked as CVE-2026-0300 is a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software which allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
The vulnerability stems from a buffer overflow issue (CWE-787) in the authentication portal component.
Affected Versions
The security flaw affects many versions of PAN-OS, such as 10.2, 11.1, 11.2, and 12.1 before some updates were fixed. But, Prisma Access, Cloud NGFW, and Panorama devices are secure.
However, exploitation is only possible when certain configurations are in place:
- The User-ID Authentication Portal is on (in either transparent or redirect mode).
- A management interface profile with “response pages” on is linked to an interface that faces untrusted or internet areas.
This mix makes it possible for attackers to reach the system and start a buffer overflow from afar.
Patches and Mitigation
Palo Alto Networks has launched updates for the affected versions, with more fixes coming by May 28, 2026. Companies should upgrade right away to the fixed versions like:
PAN-OS 12.1.4-h5 or 12.1.7+
PAN-OS 11.2.4-h17, 11.2.7-h13, or 11.2.12+
PAN-OS 11.1.4-h33, 11.1.6-h32, or 11.1.15+
PAN-OS 10.2.7-h34 or 10.2.18-h6+
For environments where patching is delayed, Palo Alto recommends the following mitigations:
Restrict User-ID Authentication Portal access to trusted internal networks only.
Disable response pages on interfaces exposed to untrusted traffic.
Completely disable the authentication portal if not required.
Enable Threat ID 510019 (Applications and Threats version 9097-10022) for detection and blocking.
