Palo Alto PAN-OS Zero-Day: What Buyers and Security Teams Need to Know About CVE-2026-0300

Palo Alto Networks has warned customers about a critical PAN-OS vulnerability that has already been exploited in the wild, putting some PA-Series and VM-Series firewalls at risk of unauthenticated remote code execution.

The vulnerability is tracked as CVE-2026-0300. It affects the User-ID Authentication Portal, also known as the Captive Portal, when that service is enabled and reachable from the internet or other untrusted networks. Palo Alto Networks rates the issue critical with a CVSS score of 9.3 in the highest-risk configuration.

The practical concern is straightforward: an attacker does not need valid credentials to trigger the flaw. By sending specially crafted packets to an exposed vulnerable portal, an attacker may be able to execute arbitrary code with root privileges on the firewall.

That makes this more than a routine patch-management item. Firewalls often sit at high-value network choke points, hold sensitive configuration data, and can provide visibility into authentication flows and internal routing. For organizations using affected PAN-OS versions, the immediate priority is to confirm whether the vulnerable portal is enabled and exposed.

As of May 8, 2026, Palo Alto Networks has described exploitation as limited and focused on User-ID Authentication Portals exposed to public or untrusted IP addresses. Software fixes are scheduled to begin arriving on May 13, 2026, with additional fixed releases planned for May 28, 2026.

What CVE-2026-0300 Affects

CVE-2026-0300 is a buffer overflow vulnerability in the User-ID Authentication Portal service in PAN-OS. The affected products are PA-Series and VM-Series firewalls running vulnerable PAN-OS versions, but exposure also depends on configuration.

The flaw is not described as broadly exploitable against every PAN-OS deployment. Palo Alto Networks says the issue applies only when the firewall is configured to use the User-ID Authentication Portal. The highest-risk cases are those where the portal is accessible from the internet or another untrusted network.

Prisma Access, Cloud NGFW, and Panorama appliances are not affected by this vulnerability.

For a firewall to be exposed, administrators should check whether both of these conditions are present:

• User-ID Authentication Portal is enabled in the Authentication Portal settings.
• An interface management profile with response pages enabled is attached to an external or internet-accessible interface.

That configuration detail matters for triage. A vulnerable PAN-OS version alone does not necessarily mean the device is reachable through the affected service. However, teams should avoid treating configuration uncertainty as safety. If asset inventory, configuration management, or firewall administration records are incomplete, the safest assumption is that the environment needs direct validation.

Affected PAN-OS Versions and Fix Timing

Palo Alto Networks has listed affected versions across PAN-OS 12.1, 11.2, 11.1, and 10.2. The company has also published target fixed versions and estimated release dates.

The staggered patch schedule creates an operational problem for teams that cannot immediately move to a fixed build. In those cases, mitigation becomes the main control until the appropriate software update is available and tested.

CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities catalog on May 6, 2026. Federal Civilian Executive Branch agencies were given a May 9, 2026 deadline to apply vendor mitigations, follow applicable guidance, or discontinue use if mitigations are not available.

Immediate Mitigation Steps

Palo Alto Networks recommends reducing risk by limiting access to the User-ID Authentication Portal or disabling it when it is not required. For security teams, the first pass should be practical and configuration-focused rather than theoretical.

Recommended actions include:

• Identify all PA-Series and VM-Series firewalls running PAN-OS 12.1, 11.2, 11.1, or 10.2.
• Confirm whether User-ID Authentication Portal is enabled.
• Determine whether the portal is reachable from the internet, partner networks, guest networks, or any other untrusted zone.
• Restrict portal access to trusted internal zones only.
• Disable Response Pages in the Interface Management Profile attached to L3 interfaces where untrusted traffic can enter.
• Disable User-ID Authentication Portal entirely if the organization does not require it.
• Plan an upgrade path to the fixed PAN-OS release for the branch currently in use.

Customers with a Threat Prevention subscription can also use Palo Alto Networks threat protection coverage for this issue by enabling the relevant threat signature when supported by their PAN-OS version. That should be treated as an additional layer, not a replacement for exposure reduction or patching.

The most urgent control is removing public or untrusted access to the affected portal. If the portal remains exposed while the device is running an affected version, the organization is accepting the highest-risk configuration described for this vulnerability.

Why This Vulnerability Matters

Remote code execution on a firewall is a high-impact condition because the device is not just another server. It may sit between trusted and untrusted networks, enforce segmentation, terminate traffic, authenticate users, log security events, and hold credentials or tokens used for integrations.

Root-level code execution can give an attacker a strong position for follow-on activity. Depending on the environment and device configuration, that could include tampering with logs, changing firewall behavior, observing traffic paths, harvesting useful configuration details, or using the firewall as a stepping stone into other systems.

The available public guidance does not mean every affected device has been compromised. It does mean teams with exposed User-ID Authentication Portals should move quickly and preserve evidence while investigating. When a network security device is potentially targeted, responders should be careful not to destroy useful logs or artifacts during emergency changes.

A sensible response plan should include both containment and review:

1. Reduce exposure first by restricting or disabling the affected portal.
2. Record the current PAN-OS version, configuration state, and internet exposure status.
3. Check firewall logs and central logging platforms for unusual access, crashes, authentication anomalies, or configuration changes.
4. Review administrator activity and recent changes around interface management profiles and User-ID settings.
5. Escalate to incident response if there is evidence of suspicious activity or if the portal was publicly reachable during the exploitation window.

Buying and Renewal Considerations

For teams evaluating firewall platforms, managed firewall services, MDR providers, exposure management tools, or vulnerability management products, CVE-2026-0300 is a useful test case. The key question is not whether a vendor can publish an advisory. It is whether your operating model can find the affected configuration quickly, reduce exposure, validate the fix path, and prove that the change happened.

A good vulnerability management process should answer several questions without days of manual chasing:

• Which firewalls are running affected PAN-OS branches?
• Which of those devices expose the affected User-ID Authentication Portal?
• Which assets are internet-facing or reachable from untrusted zones?
• Which devices have compensating controls in place?
• Which devices are waiting on a fixed release, and when will those releases be deployed?
• Can the team produce evidence for auditors, insurers, or leadership after mitigation?

This is where buyers should look beyond feature checklists. Asset inventory, configuration visibility, attack surface management, SIEM correlation, and change tracking all matter during an exploited firewall vulnerability. Products and services that cannot distinguish between a vulnerable version and an actually exposed vulnerable service will generate noise. Tools that can correlate version, configuration, exposure, and exploit intelligence are more useful during real incidents.

For managed service providers and security operations partners, the same pressure applies. A customer does not only need a ticket saying a CVE exists. They need to know whether their environment is exposed, what was changed, what remains pending, and what evidence supports the decision.

What Security Teams Should Do Next

The strongest immediate move is to validate exposure before waiting for the patch window. If User-ID Authentication Portal is not needed, disable it. If it is needed, restrict it to trusted internal access and remove response pages from interfaces that can receive untrusted traffic.

After that, align the environment to the fixed release schedule. Some PAN-OS branches have fixes expected on May 13, 2026, while others are expected on May 28, 2026. Teams should avoid assuming that one maintenance line’s release date applies to every device in the fleet.

Organizations with externally reachable portals should also treat the situation as a potential incident, not only a vulnerability ticket. That does not mean compromise is confirmed. It means the combination of active exploitation, network exposure, and root-level impact justifies a closer look.

The useful executive summary is simple: CVE-2026-0300 is a critical PAN-OS flaw under limited active exploitation, but the highest risk is concentrated in deployments where User-ID Authentication Portal is enabled and reachable from untrusted networks. Until the appropriate fixed PAN-OS release is installed, exposure reduction is the control that matters most.