Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution
Summary: Palo Alto Networks has warned that a critical buffer overflow in PAN-OS's User-ID Authentication Portal, tracked as CVE-2026-0300, allows an unauthenticated attacker to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. The flaw carries a CVSS score of 9.3 when the portal is reachable from the internet or an untrusted network and 8.7 when access is limited to trusted internal IPs, and it remains unpatched with fixes planned from May 13, 2026.
What's compelling: CISA added CVE-2026-0300 to its KEV catalog on May 6, 2026, giving federal civilian agencies until May 9, 2026 to apply fixes or mitigations - three days before Palo Alto's first patch is even due, leaving every exposed portal to be closed or disabled by hand in the interim.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0300
- Related
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Known Exploited Vulnerabilities · May 06, 2026