[KEV] Out-of-Bounds Write in Palo alto networks palo-alto-networks (CVE-2026-0300)
Summary
out-of-bounds write in Palo alto networks palo-alto-networks (CVE-2026-0300). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
Original description
The description as published by the source.
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses.
Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
Source: CISA Known Exploited Vulnerabilities NVD GitHub Advisory CISA KEV
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
A critical security issue was found in Palo Alto Networks’ PAN-OS, which allows remote attackers to gain unauthorized access to firewall systems by sending specially crafted data. This can lead to severe operational risks as attackers might control network management. Similar vulnerabilities have caused significant reputational damage in the past. It is crucial to follow vendor guidance, check if your version is affected, and consider upgrading to a patched version.
The CVE-2026-0300 is an out-of-bounds write vulnerability in Palo Alto Networks' PAN-OS within the User-ID Authentication Portal service. It allows unauthenticated attackers to execute code with root privileges by sending specially crafted packets. Detailed version information for affected and fixed versions is not provided in the summary. Immediate application of patches upon release is crucial to mitigate risks.
Out-of-bounds write vulnerability in PAN-OS allowing remote code execution.
User-ID Authentication Portal (aka Captive Portal) service in PAN-OS.
High severity, allows unauthenticated remote code execution with root privileges.
Apply the patch as soon as it is released by the vendor.
Specific workaround details are not available from the provided information.
Monitor network traffic for unusual crafted packets targeting captive portal services.
Related past incidents Similar incidents extracted from past CVEs
Log4j shell vulnerability allowed RCE by exploiting out-of-bounds conditions.
OpenSSL bug allowed attackers to read memory due to bounds checking issues.
If this happens at your company Expected impact per business scenario
攻撃者により認証情報やネットワークへの不正アクセスが発生する可能性。
金融データの改ざんやデータ損失が発生し、顧客の信用が失墜する可能性。
機密性の高い患者情報の漏洩リスクが高まる。
ベンダーのアップデートを確認し、影響を受けるシステムの現状を把握した上で、直ちに必要なセキュリティパッチを適用してください。
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'palo-alto-networks' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
palo-alto-networksを grep し、稼働しているサービス・バージョンを把握する。 -
4Consider incident declaration escalate
Notify SOC / on-callCISA KEV登録済 = 実環境で悪用が観測されている。Step 3 で兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。
-
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
References
- advisory NVD
- advisory cert-portal.siemens.com
- ICSA cisa.gov
- patch psirt@paloaltonetworks.com
- web cisa.gov
- web github.com