CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Overview
PAN-OS on PA-Series and VM-Series firewalls contains a buffer overflow in the User-ID Authentication Portal (Captive Portal) service. An unauthenticated remote attacker who can reach the portal can send specially crafted packets to trigger an out-of-bounds write, gaining arbitrary code execution with root privileges on the firewall. The flaw is present in PAN-OS versions across the 10.2, 11.1, 11.2, and 12.1 release lines. Prisma Access, Cloud NGFW, and Panorama are not affected. Active exploitation against internet-exposed portals has been observed.
Vulnerability details
The Captive Portal service in PAN-OS fails to validate the size or content of attacker-supplied network packets before writing data into an allocated buffer. This out-of-bounds write (CWE-787) corrupts adjacent memory in the service process. Because the service runs with root privileges, successful memory corruption gives an attacker full control of the underlying operating system without requiring any prior authentication or user interaction. The flaw is reachable only when two conditions are both true: the User-ID Authentication Portal is enabled under Device > User Identification > Authentication Portal Settings, and an interface management profile with Response Pages enabled is attached to an L3 interface in a zone that accepts untrusted or internet traffic.
An attacker sends specially crafted packets directly to the exposed Captive Portal service on an affected L3 interface. No credentials, session state, or prior access are required. Successful exploitation yields arbitrary code execution with root privileges on the PA-Series or VM-Series firewall, giving the attacker full control of the device, including its routing table, security policy, VPN termination, and any credentials or session data the firewall processes. Palo Alto Networks has confirmed limited exploitation in the wild targeting portals exposed to untrusted IP addresses and the public internet.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Check Device > User Identification > Authentication Portal Settings and Network > Interface management profiles: any firewall with Authentication Portal enabled and Response Pages active on an internet-facing L3 interface is in scope and should be treated as a priority for patching or isolation.
- Review firewall logs for unexpected process crashes or restarts in the User-ID or Captive Portal service, particularly correlated with inbound connection bursts from untrusted source IP ranges to the portal interface, which may indicate exploit attempts or successful memory corruption.
- Audit interface management profiles across all L3 interfaces to identify any zone where untrusted traffic can reach a Response Page-enabled profile; unexpected or undocumented profiles attached to external-facing interfaces warrant immediate investigation.
Remediation
Additional hardening
- Upgrade PAN-OS to 12.1.7 or later (12.1 line) or 11.2.12 or later (11.2 line); see the vendor advisory in References for the full set of hotfix boundaries across the 11.1 and 10.2 release lines.
- Restrict the User-ID Authentication Portal to trusted internal IP addresses only by tightening the interface management profile source restrictions, removing internet-facing exposure immediately if patching is delayed.
- Disable Response Pages in the interface management profile on every L3 interface in zones where untrusted or internet traffic can ingress; keep Response Pages active only on interfaces in internal trust zones where legitimate user browsers connect.
- Disable the User-ID Authentication Portal entirely if the feature is not actively required in the environment, eliminating the attack surface until a patched release can be deployed.
Key dates
References
Frequently asked questions
Does CVE-2026-0300 affect my FedRAMP authorization?
If Palo Alto Networks PAN-OS runs inside your authorization boundary, yes. CVE-2026-0300 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 9, 2026 has already passed. An unpatched KEV in a FedRAMP authorization boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-0300?
Knox does not patch Palo Alto Networks PAN-OS on your behalf. Remediation is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to carry out that remediation in, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. Applying the patch is yours to own; managing your compliance posture while you do it is not something you handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-0300 surfaces, exposure appears during ongoing monitoring rather than waiting until an assessor flags it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-0300's remediation deadline of May 9, 2026 has passed. What happens now?
If CVE-2026-0300 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
