What's Happening
Palo Alto Networks has disclosed CVE-2026-0300 (CVSS 9.3), a critical buffer overflow vulnerability in the User-ID Authentication Portal (Captive Portal) of PAN-OS. The flaw allows an unauthenticated remote attacker to trigger an out-of-bounds write via specially crafted network packets, leading to arbitrary code execution with root privileges on the affected device. No authentication, user interaction, or special preconditions are required beyond network access to the portal.
Palo Alto Networks has confirmed active in-the-wild exploitation in limited cases, targeting instances where the Authentication Portal is exposed to untrusted networks or the public internet. The vulnerability was published May 6, 2026, and details remain limited as of this writing. See the official Palo Alto advisory for updates.
Affected PAN-OS version branches span 10.2, 11.1, 11.2, and 12.1. Fixed versions are being released in two waves, with most patches arriving on May 13 and May 28, 2026. The full affected version matrix is available in the Wiz advisory.
Why Should You Care
A CVSS 9.3 unauthenticated RCE with root on a network firewall is as serious as vulnerabilities get. Palo Alto devices sit at the perimeter of many enterprise networks. Compromise at that layer gives an attacker full visibility into traffic, the ability to modify routing and policy, and a persistent foothold inside the network boundary, often without triggering endpoint or host-based detections.
The exploitable surface is the User-ID Authentication Portal, which listens on ports 6081 and 6082. While Wiz data indicates that roughly 7% of environments have publicly exposed PAN-OS instances, Shodan currently identifies 67 servers with port 6081 exposed to the internet. That is a small but actively targeted population given confirmed in-the-wild exploitation is already underway.
Environments that use the Captive Portal for user identification workflows (common in campus, branch, and guest network configurations) are at elevated risk if that service faces untrusted networks. Even internal-only deployments warrant attention if network segmentation between zones is weak.
What Should You Do
Apply the vendor patches as soon as they become available for your PAN-OS release branch. Most May 13 releases cover the most widely deployed hotfix versions across 10.2, 11.1, and 11.2. Check the Palo Alto advisory to confirm the target version for your specific branch.
While awaiting patches, take the following steps immediately:
- Restrict portal access. Limit access to the User-ID Authentication Portal (ports 6081 and 6082) to trusted internal IP ranges only. Block these ports at the perimeter if external access is not required.
- Disable the Authentication Portal entirely if it is not actively in use. This removes the attack surface without requiring a patch.
- Audit internet exposure. Confirm whether your PAN-OS management interfaces or portal services are reachable from untrusted networks. Use your perimeter firewall rules or check directly via Shodan for your IP ranges.
- Monitor for anomalous activity. Given active exploitation, review logs for unexpected connections on ports 6081 and 6082, unusual authentication events, and any signs of lateral movement originating from perimeter devices.
Treat this as a critical-priority patch given the confirmed in-the-wild exploitation, the lack of authentication requirements, and the attacker's resulting root-level access to a perimeter device.