CVE-2026-0300KEV · OVERDUECWE-787

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

Critical · published May 6, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.3. It is confirmed in active exploitation. It sits in the 98.3th percentile for exploit probability.

168
days past CISA
deadline
CVSS v4.0
9.3
EPSS
32%
Percentile
98.3
In the wild
Confirmed
What it is

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses.

Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red
EPSS
0.31725 · 98.3th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-05-06T18:57Z
KEV added
2026-05-06 · due 2026-05-09
EPSS history
Timeline
  • 06 MAY 18:57Z
    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
    cvelistv5
  • 06 MAY 00:00Z
    Added to CISA KEV — remediate by May 9
    kev