CVE-2026-0300

This is a weakness in a “sign-in/portal” feature on certain Palo Alto Networks network security devices. An attacker can send specially crafted network messages to overwhelm the portal’s memory handling, potentially causing the device to run attacker-controlled code as root. Think of it like a gate that’s supposed to check visitors, but a malicious visitor finds a way to break the gate’s internal “guard rails” and take control.

This matters to you if you use or run Palo Alto Networks PAN-OS on PA-Series or VM-Series firewalls that have the User-ID™ Authentication Portal enabled and reachable. It also affects the Siemens ruggedcom ape1808 firmware. Prisma Access, Cloud NGFW, and Panorama appliances are not impacted by this vulnerability.

This is RED because it’s critical and there are signs it’s being prioritized by attackers: it’s listed in CISA KEV (“known exploited in the wild”) and a public exploit exists. The estimated chance of exploitation in the next 30 days is high, so you should treat this as an urgent emergency patching issue, even though press reports say exploitation status is not yet confirmed in all environments.

1. Identify exposure

• Confirm you are on an affected platform: PA-Series or VM-Series running Palo Alto Networks PAN-OS, and/or Siemens ruggedcom ape1808 firmware.
• Confirm whether the User-ID™ Authentication Portal (Captive Portal) is enabled.
• Determine where it is reachable from (internet-facing, guest Wi‑Fi, partner networks, VPNs, internal segments, etc.). The risk is greatly reduced only when access is restricted to trusted internal IP addresses.

2. Patch (primary fix)

• Update PAN-OS to the vendor-provided fixed release for CVE-2026-0300 as soon as possible.
• If you manage a fleet, stage the update carefully in your normal change-control process but do not delay longer than necessary given the RED severity and known-exploited listing.

3. Apply containment (if patching is delayed)

• Restrict the User-ID™ Authentication Portal access to only trusted internal IP addresses using the vendor’s best-practice guidance (the portal should not be reachable broadly).
• Review firewall/VPN/ACL rules to ensure untrusted sources cannot reach the portal.

4. Validate and monitor

• After patching or rule changes, verify the portal is still functional for legitimate users, but unreachable from untrusted networks.
• Watch for unusual behavior on the firewall(s) that could indicate compromise (for example, unexpected service changes, crashes/reboots, or unexpected administrative activity). The exact indicators are not provided in the information you shared, so rely on your normal incident detection and vendor guidance.

5. Confirm non-impact scope

• Do not assume other Palo Alto components are affected: Prisma Access, Cloud NGFW, and Panorama appliances are not impacted per the provided information.

Severity and why it’s urgent: CVSS is listed as 9.8 (Critical). EPSS is 31.8% estimated probability of exploitation in the next 30 days. CISA KEV indicates it is “known exploited in the wild,” and a public exploit is available.

Affected components: A buffer overflow in the User-ID™ Authentication Portal (Captive Portal) service in Palo Alto Networks PAN-OS. This allows an unauthenticated attacker to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls via specially crafted packets.

Reduced risk condition: The risk is greatly reduced if access to the User-ID™ Authentication Portal is secured by restricting it to trusted internal IP addresses per Palo Alto Networks best-practice guidance.

Not impacted (per provided info): Prisma Access, Cloud NGFW and Panorama appliances.

Exploitation status notes: Press attention is rising, but “exploitation status (from press): none” was stated in the supplied context—however, that does not outweigh KEV presence and public exploit availability for urgent action.

Weakness type and vector: Buffer overflow in a network-facing authentication portal; the attacker does not need credentials (unauthenticated) and sends crafted packets.

EPSS / KEV meaning here: EPSS is an estimate of how likely exploitation is within a time window. KEV (“Known Exploited Vulnerabilities”) means the vulnerability has been added to a list of flaws known to be actively exploited, which is a strong signal to prioritize remediation.