Evidence dossier

CVE-2026-0300

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

74.6–90.8Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

State: PUBLISHED
Published: May 6, 2026
Updated: Jul 14, 2026
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

FIRST EPSS32.07%

2026-07-18 · v2026.06.15 · percentile 98.1%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

palo_altooriginal assertion

container

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

Jul 19, 2026Original evidence ↗

siemens-SADPunknown origin

container

Container present

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.320740000000; percentile 0.981240000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

Palo Alto NetworksCloud NGFW

[{"status": "unaffected", "version": "All", "versionType": "custom"}]unknown

Palo Alto NetworksPAN-OS

[{"status": "affected", "version": "12.1.0", "lessThan": "12.1.7", "versionType": "custom"}, {"status": "affected", "version": "11.2.0", "lessThan": "11.2.12", "versionType": "custom"}, {"status": "affected", "version": "11.1.0", "lessThan": "11.1.15", "versionType": "custom"}, {"status": "affected", "version": "10.2.0", "lessThan": "10.2.18-h6", "versionType": "custom"}]

unknown

Palo Alto NetworksPrisma Access

[{"status": "unaffected", "version": "All", "versionType": "custom"}]unknown

SiemensRUGGEDCOM APE1808

[{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}]unknown