CVE-2026-0300

What it actually does

CVE-2026-0300 is a network-reachable buffer overflow in the PAN-OS User-ID Authentication Portal, also known as Captive Portal. An unauthenticated attacker can send specially crafted packets to the portal service and corrupt memory in a way that allows arbitrary code execution as root on affected PA-Series and VM-Series firewalls. Because the vulnerable component is part of the firewall management/security control plane, successful exploitation can give an attacker full operating-system-level control of the appliance, enabling configuration tampering, traffic inspection or disruption, credential theft, persistence, and pivoting into protected networks. Prisma Access, Cloud NGFW, and Panorama are not reported as impacted.

Why it matters to the business

This is a critical perimeter-device compromise risk: an exposed vulnerable firewall can be taken over without credentials or user interaction. Business consequences may include loss of network availability, bypass or weakening of security policy enforcement, interception of sensitive traffic, unauthorized changes to firewall rules or VPN/User-ID settings, and use of the firewall as a foothold for broader intrusion. The issue is listed in CISA KEV with active exploitation observed in the wild and a remediation due date of 2026-05-09, so organizations should treat internet- or untrusted-network-exposed Captive Portal services as urgent even though ransomware use is not currently indicated.

How an attack unfolds

An attacker first identifies PAN-OS firewalls exposing the User-ID Authentication Portal/Captive Portal service to an untrusted network. They then send malformed network traffic crafted to trigger the buffer overflow in the portal service. If exploitation succeeds, the attacker gains code execution with root privileges on the firewall. From that position, they may deploy persistence, inspect or modify configuration, create or alter administrative access, capture credentials or session material, disable logging or security controls, and use the firewall’s trusted network position to access internal systems. Exploitation has been reported as active in the wild, so detection should assume attackers may attempt both opportunistic scanning and targeted exploitation of exposed portals.

How to fix it

Upgrade affected PAN-OS PA-Series and VM-Series firewalls to vendor-fixed releases as specified in the official Palo Alto Networks advisory for this vulnerability. No exact fixed versions were provided in the input, so remediation programs should verify the current vendor advisory before scheduling upgrades. Immediately reduce exposure by restricting access to the User-ID Authentication Portal/Captive Portal to trusted internal IP addresses only, following Palo Alto Networks best-practice guidance. If the portal is not required, disable it. Block access from the internet and other untrusted networks using upstream ACLs, security policy, or interface management profiles as appropriate. For suspected compromise, isolate the firewall from untrusted networks where operationally feasible, preserve forensic artifacts, collect a tech-support bundle, rotate administrator credentials, API keys, and relevant certificates, review configuration for unauthorized changes, and consider rebuilding or factory-resetting the device from trusted media before returning it to service.

How to confirm the fix worked

Confirm whether each firewall is a PA-Series or VM-Series PAN-OS device and whether the User-ID Authentication Portal/Captive Portal is enabled. Verify the installed PAN-OS version against the official vendor advisory and confirm it is at or above a fixed release. Validate that Prisma Access, Cloud NGFW, and Panorama-only appliances are not incorrectly included in the vulnerable population. Test exposure from untrusted network locations using benign connectivity checks only, verifying that the portal is not reachable except from explicitly trusted internal IP ranges. Review firewall policy, interface profiles, GlobalProtect/User-ID/Captive Portal configuration, and upstream network controls to confirm access restrictions are enforced. After patching or mitigating, monitor for service crashes, unexpected restarts, configuration changes, new administrative accounts, suspicious outbound connections from the firewall, and anomalous log gaps.

Typical attack path

1. Scan public or partner-facing address space for Palo Alto Networks PAN-OS User-ID Authentication Portal/Captive Portal exposure.
2. Confirm the exposed service is reachable from an untrusted network and appears to be running an affected PAN-OS build on a PA-Series or VM-Series firewall.
3. Send specially crafted packets to the portal service to trigger the buffer overflow.
4. Achieve arbitrary code execution in the context of the affected service and elevate or execute as root as permitted by the flaw.
5. Establish persistence, modify firewall configuration, add credentials, or stage tooling on the appliance.
6. Use the compromised firewall to monitor traffic, weaken access controls, disrupt network availability, or pivot into protected networks.
7. Attempt to hide activity by clearing or modifying logs, disabling telemetry, or blending into normal firewall management activity.

How to detect it

Investigate both exploitation attempts and post-compromise activity. Review PAN-OS system, traffic, threat, configuration, authentication, and User-ID/Captive Portal-related logs around any period when the portal was exposed. Prioritize evidence of malformed or high-volume requests to the Captive Portal from unknown IPs, crashes or restarts of User-ID/authentication-related processes, unexpected management-plane reboots, core dumps, and sudden log gaps. Examine configuration logs for newly created administrators, changed authentication profiles, modified Captive Portal/User-ID settings, altered security or NAT rules, disabled logging, or unexpected commits. Review system logs for process faults, segmentation faults, watchdog restarts, and unexplained management-server or User-ID daemon events. Inspect for suspicious outbound connections from the firewall management plane, unfamiliar files or scripts, unauthorized SSH or CLI sessions, and unexpected scheduled tasks. If available, compare current running configuration with a known-good baseline and validate administrator login history against expected maintenance windows. Because public indicators may be sparse for buffer-overflow exploitation, absence of known IoCs should not be treated as proof of non-compromise; use behavioral evidence, crash artifacts, and configuration integrity checks.

• useridd
• authd
• captive portal
• Captive Portal
• User-ID
• segmentation fault
• segfault
• core dumped
• core file
• watchdog
• process restarted
• unexpected restart
• management plane restart
• mp-log useridd.log
• mp-log authd.log
• mp-log system.log
• mp-log configd.log
• mp-log ms.log
• /var/log/pan/useridd.log
• /var/log/pan/authd.log
• /var/log/pan/system.log
• /var/log/pan/configd.log
• /var/log/pan/ms.log
• show system files
• show admins
• show config audit
• show system software status
• commit by
• admin account created
• configuration committed
• failed authentication
• successful authentication

What your security team should do

• Immediately inventory PAN-OS PA-Series and VM-Series firewalls and identify any with User-ID Authentication Portal/Captive Portal enabled.
• Prioritize patching or mitigation for any portal reachable from the internet, partner networks, guest networks, or other untrusted segments.
• Apply vendor-fixed PAN-OS versions from the official Palo Alto Networks advisory; where immediate upgrade is not possible, restrict portal access to trusted internal IP addresses or disable the service.
• Because this vulnerability is in CISA KEV and actively exploited, perform retrospective threat hunting on affected devices for signs of compromise before and after remediation.
• Collect and preserve logs, configuration snapshots, and support bundles from exposed devices before making major recovery changes if compromise is suspected.
• Rotate firewall administrator credentials, API keys, service credentials, and relevant certificates if there is any indication the appliance was compromised.
• Review configuration for unauthorized admin users, altered security policies, modified NAT/VPN/User-ID settings, disabled logging, or unexpected scheduled jobs/scripts.
• Increase monitoring for abnormal management-plane behavior, service crashes, unexpected reboots, and outbound connections initiated by the firewall.
• Ensure Captive Portal is never broadly exposed; enforce least-access network controls and document approved source ranges for the service.