Exploit for CVE-2026-0300

cve · 2026-05-06

Description

CVE-2026-0300: Unauthenticated buffer overflow in the User-ID Portal may permit root code execution on Palo Alto Networks firewalls.

Entry point

ParameterCookie · header

Path/

PAN-OS User-ID Portal buffer overflow exposed via root path.

Affected Paloaltonetworks Pan-os versions

Paloaltonetworks Pan-os= 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5, 10.2.6, 10.2.7, 10.2.8, 10.2.9, 10.2.10, 10.2.11, 10.2.12, 10.2.13, 10.2.14, 10.2.15, 10.2.16, 10.2.17, 10.2.18, 11.1.0, 11.1.1, 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.1.9, 11.1.10, 11.1.11, 11.1.12, 11.1.13, 11.1.14, 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 11.2.5

All known vulnerabilities by product

Pa-Series Pan-Os Vm Series

CVSS 9.8 for CVE-2026-0300

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

EPSS Score

31.7%higher than 98.2% of all CVEs

Updated 2026-08-27

CVE Information

CVE-2026-0300

References

https://security.paloaltonetworks.com/CVE-2026-0300

https://cert-portal.siemens.com/productcert/html/ssa-967325.html

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300

Exploit Details

Modified:2026-06-17 10:10

Last Seen:2026-08-25 00:17

Reporter:palo_alto

Other exploits for CVE-2026-0300

POC-CVE-2026-0300-exploit

2026-08-26 KitPloitKITPLOIT

CVE-2026-0300

2026-08-26 KitPloitKITPLOIT

CVE-2026-0300

2026-08-26 KitPloitKITPLOIT

panos-captive-portal-rce

2026-08-21 KitPloitKITPLOIT

Exploit for Out-of-bounds Write in Paloaltonetworks Pan-Os

2026-08-06 sam00GITHUB

Exploit for Out-of-bounds Write in Paloaltonetworks Pan-Os

2026-05-22 ridhinvaGITHUB

Exploit for Out-of-bounds Write in Paloaltonetworks Pan-Os

2026-05-21 lu4m575GITHUB

Exploit for Out-of-bounds Write in Paloaltonetworks Pan-Os

2026-05-11 ByteWraith1GITHUB

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=CVE-2026-0300
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. 

The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the  best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail  by restricting access to only trusted internal IP addresses.

Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Exploit Code

Share

Share on social media: