CVE-2026-0300 — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Exploitation status

CVE-2026-0300 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2026-05-06. Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

Advisory facts

Vendor or project

Palo Alto Networks

Affected product

PAN-OS

Added to CISA KEV

2026-05-06

US federal remediation due date

2026-05-09

Ransomware association

Unknown

EPSS score

32.1% chance of exploitation in 30 days

Weakness (CWE)

CWE-787

Remediation: the required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

Wording published by CISA for this catalog entry. It is the baseline action, not a decision about your environment: whether this exposure matters for you depends on where the affected component runs, what it is exposed to and who owns it.

From advisory to a decision you can defend

A catalog entry tells you a vulnerability is being exploited somewhere. It does not tell you whether it matters in your estate, who owns the fix, or what evidence an auditor will ask for later. That is the work VulnTrek does: it takes findings from the tools you already run, decides which exposure actually matters, routes it to an owner, keeps remediation human-approved and retains the lineage as evidence.