Palo Alto warns of critical firewall flaw, tells users patch is on the way

A critical buffer overflow flaw (CVE‑2026‑0300) in the PAN‑OS User ID Authentication Portal is under limited exploitation
Bug allows unauthenticated code execution with root privileges on exposed firewalls
Palo Alto recommended restricting portals to trusted networks; fixes expire May 13, 2026

The PAN-OS User ID Authentication Portal, a feature of Palo Alto Networks firewalls that identifies and authenticates users on a network, contains a critical severity zero-day vulnerability that is being exploited in limited attacks, the company warned.

The bug is described as a buffer overflow weakness that allows unauthenticated threat actors to execute arbitrary code with root privileges on PA and VM series firewalls via specially crafted packets.

It is tracked as CVE-2026-0300 and was assigned a severity score of 9.3/10 (critical). It only works against endpoints that are exposed to the public Internet.

Guidance and patches

“Limited exploitation has been observed targeting Palo Alto Networks User-ID™ authentication portals that are exposed to untrusted IP addresses and/or the public Internet,” Palo Alto explained in a security advisory.

“Customers who follow standard security best practices, such as restricting sensitive portals to trusted internal networks, are at significantly reduced risk.”

In an additional statement shared with beepcomputerThe company said the vulnerability was specific to a “limited number” of customers with their authentication portals exposed to the public Internet or untrusted IP addresses. “We have observed limited exploitation of this issue and are working to release software fixes, with the first updates expected to be available on May 13, 2026,” the company told the publication.

“We have provided clear mitigation guidance to our customers to protect their environments immediately. This issue does not affect Cloud NGFW or Panorama appliances.”

Users who are unsure whether or not they are exposed can see if their firewalls are configured to use the vulnerable service from the Settings page. They can navigate to Device – User ID – Authentication Portal Settings – Enable Authentication Portal. Access to the portal should be restricted to trusted areas only, or even disabled, if possible, Palo Alto advised.

According to data from Shadowserver, there are currently 5,800 PAN-OS VM series firewalls exposed online. The majority are found in Asia (2,466), with a significant minority in North America (1,988).