CVE-2026-0300

A critical buffer overflow vulnerability exists within the User-ID™ Authentication Portal service of Palo Alto Networks' PAN-OS software. This flaw allows an unauthenticated attacker to send specially crafted packets that can lead to arbitrary code execution with root privileges on the affected PA-Series and VM-Series firewalls. The underlying issue arises from improper handling of input data, which can cause the memory to be overwritten, potentially leading to the execution of malicious code. The severity of this vulnerability is underscored by its high CVSS score of 9.3, indicating a significant risk to systems that do not implement adequate security measures.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could leverage the User-ID™ Authentication Portal, which is typically exposed to the network, to send crafted packets that exploit the buffer overflow. Since the vulnerability does not require authentication, it poses a substantial threat, especially in environments where the portal is accessible from untrusted networks. Attack scenarios could range from unauthorized access to sensitive data, disruption of services, or even complete takeover of the firewall, which could lead to further exploitation of the internal network.

The real-world impact of this vulnerability is profound, particularly for organizations relying on Palo Alto Networks firewalls for their security posture. A successful exploit could result in unauthorized access to critical infrastructure, leading to data breaches, service outages, and significant financial losses. The potential for attackers to execute arbitrary code with root privileges means that they could manipulate firewall settings, disable security features, or pivot to other systems within the network. This not only compromises the integrity of the firewall but also exposes the organization to regulatory penalties and reputational damage.

To detect and mitigate this vulnerability, organizations should prioritize implementing best practice guidelines for securing access to the User-ID™ Authentication Portal. This includes restricting access to only trusted internal IP addresses, thereby minimizing the attack surface. Regularly updating the PAN-OS software to the latest versions is crucial, as vendors typically release patches to address known vulnerabilities. Additionally, employing intrusion detection systems (IDS) and intrusion prevention systems (IPS) can help identify and block malicious traffic attempting to exploit this vulnerability. Continuous monitoring and logging of firewall activities can also aid in the early detection of suspicious behavior, allowing for timely incident response.

In conclusion, the buffer overflow vulnerability in the User-ID™ Authentication Portal of Palo Alto Networks PAN-OS represents a significant threat to organizations utilizing these firewalls. Given the potential for severe consequences, it is imperative for organizations to adopt a proactive security posture. By implementing stringent access controls, maintaining up-to-date software, and leveraging security monitoring tools, organizations can effectively mitigate the risks associated with this vulnerability and protect their critical assets from exploitation.

CSURFACE threat intelligence has detected a marked escalation in exploitation activity targeting CVE-2026-0300, evidenced by a significant rise in telemetry signals and the emergence of multiple new proof-of-concept exploits publicly available on GitHub. This development is compounded by the vulnerability’s recent inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, underscoring its elevated priority for remediation within critical infrastructure environments. The EPSS score increase to 0.1443, placing it near the 94th percentile, further validates the growing likelihood of exploitation attempts in the wild. The availability of diverse exploitation tools lowers the barrier for threat actors, potentially expanding the attacker base beyond advanced persistent threat groups to include opportunistic actors. Collectively, these factors elevate the threat level from high to critical, signaling an urgent need for heightened vigilance and accelerated defensive measures by organizations deploying affected Palo Alto Networks PAN-OS firewalls.

Update 2 — May 22, 2026

CSURFACE threat intelligence has identified a recalibration of the CVSS score for CVE-2026-0300 from 0.0 to 9.8, reflecting a critical reassessment of the vulnerability’s severity. This adjustment coincides with a slight uptick in detection activity and the emergence of multiple new proof-of-concept exploits publicly available on GitHub, broadening the exploit landscape and lowering the technical barriers for adversaries. Interestingly, despite these developments, the EPSS score has decreased significantly, suggesting a current reduction in the overall probability of widespread exploitation, although recent trends indicate a modest increase in exploit attempts. This nuanced dynamic underscores a complex threat environment where the vulnerability’s potential impact remains severe, but exploitation frequency is fluctuating. For defenders, this means that while the risk of successful attacks remains critically high due to the vulnerability’s root-level code execution capability, the immediate likelihood of exploitation is somewhat moderated but not negligible. Consequently, the threat level should be maintained at critical, emphasizing the need for continued vigilance as the availability of diverse exploitation tools could rapidly accelerate attack activity.

Update 3 — July 23, 2026

CSURFACE threat intelligence has detected a modest increase in exploitation attempts targeting CVE-2026-0300, reflected by a slight rise in telemetry activity. Despite this uptick, the Exploit Prediction Scoring System (EPSS) score has decreased, indicating a marginally reduced likelihood of widespread exploitation in the immediate term. The presence of multiple publicly available proof-of-concept exploits continues to lower the barrier for adversaries, sustaining a persistent threat environment. The stable short-term EPSS trend suggests no rapid acceleration in exploitation, but the increased detection frequency signals that threat actors remain actively probing this vulnerability. Consequently, while the overall risk remains critical due to the vulnerability’s capacity for unauthenticated root-level code execution, defenders should interpret this as a call for sustained vigilance rather than an indication of imminent large-scale attacks.

Update 4 — August 15, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2026-0300, accompanied by the emergence of several new proof-of-concept exploits publicly available on GitHub. This expansion in the exploit toolkit lowers the technical barrier for adversaries, enabling a broader range of threat actors to attempt remote code execution on vulnerable Palo Alto Networks firewalls. Our telemetry indicates that while the overall exploitation frequency remains stable in the short term, the qualitative increase in detection activity reflects heightened adversary interest and probing efforts. The availability of diverse exploit variants also suggests potential for more sophisticated or automated attack campaigns in the near future. Consequently, the threat level associated with CVE-2026-0300 has intensified, reinforcing its critical status and underscoring the sustained risk of unauthorized root-level compromise in affected environments.