InfoSecBulletin Cybersecurity for mankind
A critical flaw in Palo Alto Networks PAN-OS is putting business firewalls at risk. It lets unverified attackers run any code they want with full control.
Tracked as CVE-2026-0300 is a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software which allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The vulnerability stems from a buffer overflow issue (CWE-787) in the authentication portal component.
Affected Versions
The security flaw affects many versions of PAN-OS, such as 10.2, 11.1, 11.2, and 12.1 before some updates were fixed. But, Prisma Access, Cloud NGFW, and Panorama devices are secure.
However, exploitation is only possible when certain configurations are in place:
- The User-ID Authentication Portal is on (in either transparent or redirect mode).
- A management interface profile with “response pages” on is linked to an interface that faces untrusted or internet areas.
This mix makes it possible for attackers to reach the system and start a buffer overflow from afar.
Patches and Mitigation
Palo Alto Networks has launched updates for the affected versions, with more fixes coming by May 28, 2026. Companies should upgrade right away to the fixed versions like:
PAN-OS 12.1.4-h5 or 12.1.7+
PAN-OS 11.2.4-h17, 11.2.7-h13, or 11.2.12+
PAN-OS 11.1.4-h33, 11.1.6-h32, or 11.1.15+
PAN-OS 10.2.7-h34 or 10.2.18-h6+
For environments where patching is delayed, Palo Alto recommends the following mitigations:
Restrict User-ID Authentication Portal access to trusted internal networks only.
Disable response pages on interfaces exposed to untrusted traffic.
Completely disable the authentication portal if not required.
Enable Threat ID 510019 (Applications and Threats version 9097-10022) for detection and blocking.
