InfoSecBulletin Cybersecurity for mankind
Palo Alto Networks is fixing a serious PAN-OS zero-day flaw that was used to hack some of its firewall. Tracked as CVE-2026-0300, this issue is a buffer overflow that affects the User-ID Authentication Portal (Captive Portal) service of PAN-OS software.
“Limited exploitation has been observed targeting Palo Alto Networks User-ID Authentication Portals that are exposed to untrusted IP addresses and/or the public internet,” Palo Alto Networks said in an advisory.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Shadowserver is currently watching more than 5,800 PAN-OS VM-series firewalls that are visible online. Many of these are in Asia (2,466) and North America (1,998).
The company has also flagged the vulnerability as the highest possible severity and says that admins can quickly check whether their firewalls are configured to use the vulnerable service from the User-ID Authentication Portal Settings page, found under Device > User Identification > Authentication Portal Settings -> Enable Authentication Portal.
No other details have been given about the attacks using CVE-2026-0300, but little use usually means that a weakness has been used in targeted attacks by skilled threat actors, often supported by states.
The vendor plans to give out the first set of updates on May 13, with another set of fixes expected on May 28.
Palo Alto said the problem only impacts PA and VM series firewalls set up to use the User-ID Authentication Portal. Allowing access to the portal only for trusted internal IPs greatly lowers the chance of exploitation.
Affected Products
The vulnerability impacts multiple PAN-OS versions across PA-Series and VM-Series firewalls. Affected branches include:
PAN-OS 10.2 : versions below 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, and 10.2.18-h6
PAN-OS 11.1: versions below 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, and 11.1.15
PAN-OS 11.2: versions below 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, and 11.2.12
PAN-OS 12.1: versions below 12.1.4-h5 and 12.1.7
According to Palo Alto Networks, Prisma Access, Cloud NGFW, and Panorama appliances are not affected by CVE-2026-0300.
Palo Alto firewalls are popular with enterprise and government, making them key targets for hackers.
