CVE-2026-0300 is a zero-day buffer overflow vulnerability in the Captive Portal service of PAN-OS software on PA and VM series firewalls by Palo Alto Networks. This flaw allows unauthenticated attackers to gain root-level code execution by sending specially crafted packets to the User-ID Authentication Portal. Exploitation has been limited and observed only on portals exposed to untrusted or public IP addresses. The vendor is actively developing patches, with initial fixes scheduled for May 13, 2026, and follow-up patches on May 28. The vulnerability does not affect other Palo Alto products such as Prisma Access, Cloud NGFW, or Panorama. Mitigation includes restricting portal access to trusted internal IP addresses.

Successful exploitation of CVE-2026-0300 enables an unauthenticated attacker to execute arbitrary code with root privileges on affected PA and VM series firewalls configured with the User-ID Authentication Portal. This could lead to full compromise of the firewall device. Limited exploitation observed suggests targeted attacks, likely by sophisticated threat actors. Other Palo Alto products are not impacted. No widespread exploitation or inclusion in CISA's Known Exploited Vulnerabilities catalog has been reported as of the advisory date.

Palo Alto Networks is releasing official patches starting May 13, 2026, with a second round on May 28, 2026. Organizations should apply these patches promptly once available. Until patched, it is recommended to restrict access to the User-ID Authentication Portal to trusted internal IP addresses only, avoiding exposure to untrusted or public networks. No other mitigation actions are indicated by the vendor at this time.