Critical PAN-OS Authentication Portal Flaw Enables Root RCE on Exposed Firewalls
Active Exploitation · 2 sources · Updated 3mo ago · First seen May 6, 2026
Palo Alto Networks disclosed and patched CVE-2026-0300, a critical PAN-OS vulnerability in the User-ID Authentication Portal that can let an unauthenticated remote attacker execute arbitrary code with root privileges. The flaw, rated CVSS 9.3, is described as a stack overflow and out-of-bounds write issue affecting multiple PAN-OS release lines, including versions in the 10.2, 11.1, 11.2, and 12.1 branches, on affected PA Series and VM-Series firewalls.
Palo Alto Networks reported signs of active exploitation, particularly on devices exposed to the internet or reachable from untrusted IP addresses, and CISA added the bug to its Known Exploited Vulnerabilities catalog. Exploitation depends on the Authentication Portal being enabled and a management interface profile with a response page being attached to a Layer 3 interface reachable by untrusted traffic; defenders were urged to upgrade to fixed releases, restrict portal access to trusted zones or IP addresses, disable the feature if unnecessary, and investigate systems for signs of compromise.
