Full Report
Palo Alto Networks warned customers today that a critical-severity unpatched vulnerability in the PAN-OS User-ID Authentication Portal is being exploited in attacks. [...]
Analysis Summary
# Vulnerability: PAN-OS User-ID Authentication Portal Buffer Overflow
## CVE Details
- **CVE ID:** CVE-2026-0300
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-121 (Stack-based Buffer Overflow) / CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
## Affected Systems
- **Products:** Palo Alto Networks PA-Series (Hardware) and VM-Series (Virtual) Firewalls.
- **Versions:** PAN-OS (Specific version range not detailed in the article, but implied across current production releases).
- **Configurations:** Firewalls with the **User-ID Authentication Portal** (Captive Portal) enabled and exposed to untrusted networks or the public internet.
## Vulnerability Description
CVE-2026-0300 is a critical buffer overflow vulnerability residing in the User-ID Authentication Portal component of PAN-OS. The flaw is triggered when the portal processes specially crafted network packets. Because this component handles initial user authentication, an unauthenticated attacker can exploit this memory corruption bug to achieve Remote Code Execution (RCE) with elevated (**root**) privileges.
## Exploitation
- **Status:** **Exploited in the wild** (Zero-day status; limited targeted exploitation observed).
- **Complexity:** Low (Targeting exposed internet-facing portals).
- **Attack Vector:** Network (Unauthenticated).
## Impact
- **Confidentiality:** Total (Root access allows full data access).
- **Integrity:** Total (Attackers can modify system configurations and security policies).
- **Availability:** Total (Attackers can disable firewall protections or crash the system).
## Remediation
### Patches
- **None currently available.** Palo Alto Networks is reportedly still working on a fix for this zero-day vulnerability.
### Workarounds
- **Restrict Access:** Limit access to the User-ID Authentication Portal to trusted internal IP addresses/zones only.
- **Disable the Portal:** If the portal is not mission-critical, disable it entirely via:
* `Device` > `User Identification` > `Authentication Portal Settings` > Uncheck `Enable Authentication Portal`.
- **General Best Practices:** Ensure management interfaces are not exposed to the public internet.
## Detection
- **Indicators of Compromise:** Monitor for unusual incoming traffic to the Captive Portal port (typically ports 6080, 6081, or 6082 depending on configuration).
- **Detection methods and tools:**
* Check for the exposure of VM-Series firewalls using tools like Shadowserver.
* Review PAN-OS system logs for unexpected reboots or crashes of the `authd` process.
* Audit current configurations under `Authentication Portal Settings` to identify exposed interfaces.
## References
- **Vendor Advisory:** hxxps[://]security[.]paloaltonetworks[.]com/CVE-2026-0300
- **Configuration Guide:** hxxps[://]docs[.]paloaltonetworks[.]com/ngfw/administration/user-id/map-ip-addresses-to-users/map-ip-addresses-to-usernames-using-captive-portal/configure-captive-portal
- **Threat Intelligence:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?date_range=7&vendor=palo+alto+networks&type=firewall&dataset=count&limit=100&group_by=geo&stacking=stacked