CVE-2026-0300 is a critical zero-day vulnerability affecting Palo Alto Networks PAN-OS firewalls. The flaw exists within the User-ID™ Authentication Portal and allows an unauthenticated, remote attacker to execute arbitrary code with root privileges via specially crafted network packets.
The User-ID™ Authentication Portal, also known as the Captive Portal, is triggered when the firewall encounters traffic from an unknown user that requires authentication to satisfy a security policy rule. The firewall intercepts the session and redirects the user to the Authentication Portal to provide credentials via a web form.
The service is inherently exposed to unauthenticated users, as its primary purpose is to identify and authenticate those who are not yet known to the system. Vulnerability resides in the packet-parsing logic of the service, which is responsible for handling the initial handshake and protocol exchange before any authentication has occurred.
The technical root cause of CVE-2026-0300 is an out-of-bounds write, specifically a buffer overflow, which occurs during the processing of incoming network packets. This type of memory corruption vulnerability arises when a program writes more data to a buffer than it is designed to hold, leading to the overwriting of adjacent memory locations. In the context of the User-ID™ Authentication Portal, the flaw is triggered by "specially crafted packets" sent by an unauthenticated attacker.
By meticulously crafting the length and content of these packets, an attacker can manipulate the instruction pointer or return addresses on the stack. The successful exploitation of this flaw leads to remote code execution (RCE) with root privileges. Root-level access on a firewall is catastrophic because it grants the attacker total control over the appliance's operating system. This allows for the modification of security rules, the disabling of logging mechanisms, the exfiltration of sensitive configuration files, and the deployment of persistent backdoors within the firewall's underlying Linux environment.
Palo Alto Networks has identified that the vulnerability affects all current major release branches of PAN-OS, specifically versions 10.2, 11.1, 11.2, and 12.1. The following PA-Series and VM-Series firewalls are susceptible to exploitation if they have the User-ID™ Authentication Portal enabled.
Importantly, managed cloud services like Prisma Access and Cloud NGFW, as well as Panorama appliances, remain unaffected.
The presence of "h" (hotfix) versions indicates that Palo Alto Networks is releasing out-of-band updates specifically to address this critical flaw without requiring a move to a completely new minor release, which might introduce other architectural changes. This strategy is designed to minimise the operational downtime and testing requirements for administrators who must act quickly to mitigate the zero-day risk.
Until hotfixes can be applied, organisations should execute the following immediate action plan to secure their environments:
