Author: VulnTracker
Published: May 6, 2026
Source: https://vulntracker.io/blog/palo-alto-pan-os-cve-2026-0300-unauth-rce-active-exploitation/
Summary
VulnTracker reports on CVE-2026-0300, a critical unauthenticated remote code execution flaw in Palo Alto Networks PAN-OS firewalls that, at the time of writing (May 6, 2026), was under active exploitation with no patch available until May 13, 2026. An unauthenticated attacker can obtain full root control of an affected firewall with a single crafted request, but only when the User-ID Authentication Portal (Captive Portal) is enabled. The article frames the immediate triage question as whether that portal is exposed to the internet, and stresses managing a week-long exposure window with workarounds rather than a fix.
Technical Details
The vulnerability affects PAN-OS running on PA-Series hardware and VM-Series virtual firewalls, and is only reachable when the User-ID Authentication Portal (also called the Captive Portal) is enabled. It is rated CVSS 9.3 when the portal is internet-exposed and 8.7 when restricted to trusted networks. Prisma Access, Cloud NGFW, and Panorama are not affected. The article does not publish a detailed root-cause analysis, but notes the historical parallel to CVE-2020-2040, which affected the same Captive Portal component with the same bug class (buffer overflow) and same impact (unauthenticated root RCE) six years earlier — implying a comparable memory-safety issue in the portal’s request handling. Beyond that comparison, the source does not specify the exact internal mechanism, so no further root-cause detail is asserted here.
Impact
Successful exploitation yields root code execution on the firewall from an unauthenticated position. As the article emphasizes, root on a perimeter firewall is a privileged vantage point between the internal network and the internet: credentials, session tokens, and internal API calls traversing the device become exposed, and the appliance typically runs no EDR and has under-monitored logs, so a compromise can persist quietly. Palo Alto characterized exploitation as “limited,” which the author interprets as sophisticated, targeted activity that commonly precedes wider scanning. Internet-exposed Authentication Portals are the active targets.
Mitigation
At publication no patch existed; fixes were scheduled to begin landing May 13, 2026. The recommended interim actions: confirm whether the Authentication Portal is enabled and internet-exposed (Device > User Identification > Authentication Portal Settings), and if so restrict it to trusted networks or disable it entirely where it is not needed — the article notes most enterprise deployments do not require the portal to be internet-reachable. Teams are also advised to pre-stage emergency patch deployment, hunt for prior compromise (treating any recently exposed portal as potentially compromised, reviewing auth logs, admin accounts, and recent config changes), and after patching, review perimeter patch SLAs and inventory. Consult Palo Alto’s official advisory for authoritative affected-version and fixed-build details.