Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)

1. Apply Official Security Patches

Refer to the Palo Alto Networks security advisory and upgrade PAN-OS to the patched maintenance release designated for your specific hardware or virtual appliance model.

2. Temporary Mitigations

If patching cannot be performed immediately, implement the following mitigation steps to reduce exposure:

• Restrict Access: Limit access to the User-ID™ Authentication Portal strictly to trusted internal IP addresses according to vendor best practices.
• Security Policy Configuration Example:

  Source: Trust-Zone (Trusted Internal Subnets)
  Destination: Untrust-Zone (Firewall Interface)
  Service: TCP/Secure-HTTP (Captive Portal Port)
  Action: Allow
  
  (Ensure a default Deny rule is applied for all untrusted external sources)

• Enable Threat Prevention: Ensure that the latest IPS signatures for CVE-2026-0300 are enabled and set to 'Drop' on all perimeter security profiles.

This vulnerability (CVE-2026-0300) is a critical Out-of-bounds Write (CWE-787, buffer overflow) vulnerability within the User-ID™ Authentication Portal (also known as Captive Portal) service of Palo Alto Networks PAN-OS.

An unauthenticated attacker can exploit this flaw by sending specially crafted packets to the authentication portal service. Due to insufficient boundary validation of incoming network packets, a buffer overflow occurs, allowing the attacker to hijack the execution flow and run arbitrary commands with elevated root privileges on the underlying operating system.

With a CVSS 3.1 score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability represents an active threat that requires immediate remediation to prevent perimeter compromise.