cyber.hendryadrian.com

CVE

CVE-2026-0300

First Reported
Sep 8, 2026
Latest Reported
Sep 8, 2026
Articles
1
View articles →
IOC
0
View indicators →

CVE Enrichment

CVSS
9.3 CRITICAL
EPSS
31.73%
EPSS Percentile
98.26%
CISA KEV
YES — Known Exploited Vulnerability

Description

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Technical Details

CVSS Version
4.0
CNA / NVD Source
psirt@paloaltonetworks.com
Published
07-May-2026 02:16
Last Modified
17-Jun-2026 17:10
EPSS Date
2026-10-11
CWE
CWE-787

CVSS Vector

CVSS:4.0 AV:N / AC:L / AT:N / PR:N / UI:N / VC:H / VI:H / VA:H / SC:L / SI:L / SA:N / E:A / CR:X / IR:X / AR:X / MAV:X / MAC:X / MAT:X / MPR:X / MUI:X / MVC:X / MVI:X / MVA:X / MSC:X / MSI:X / MSA:X / S:X / AU:Y / R:U / V:C / RE:M / U:Red

CISA KEV Details

Date Added
2026-05-06
Remediation Due
2026-05-09
Known Ransomware Campaign Use
Unknown
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
Notes
https://security.paloaltonetworks.com/CVE-2026-0300 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0300

Affected Products / Versions

References

Last enrichment sync: 12-Oct-2026 21:30
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE (71)

CVE-2010-39041 related articleCVE-2015-32461 related articleCVE-2015-52871 related articleCVE-2017-01991 related articleCVE-2017-57531 related articleCVE-2017-79211 related articleCVE-2019-10681 related articleCVE-2019-189351 related articleCVE-2020-07961 related articleCVE-2020-10131 related article

VIEW MORE

Malware (4)

BadIIS1 related articleNoodleRAT1 related articleQuasarRAT1 related articleSPECTRE1 related article

Threat Actors (1)

UAT-101471 related article

Vendors (22)

Alibaba Group1 related articleApache1 related articleApple1 related articleAtlassian1 related articleBroadcom1 related articleCisco1 related articleCitrix1 related articleF51 related articleFortinet1 related articleGitLab1 related article

VIEW MORE

Products (18)

AjaxPro1 related articleApache Tomcat1 related articleGitea1 related articleIBM Langflow1 related articleLangflow1 related articleMarimo1 related articleMetabase1 related articleMLflow1 related articlen8n1 related articleNacos1 related article

VIEW MORE

Tools (7)

DeepAudit1 related articleDeepSeek1 related articleEfsPotato1 related articleHermes Agent1 related articleMeterpreter1 related articleNuclei1 related articlePentestGPT1 related article

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.