Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
VulnerabilityKnown exploitedExploit likelihood 42%

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

CVE-2026-0300 · CISA KEV · May 6, 2026

Summary

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

From CISA, quoted as published. Check the source before acting.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.

CISA required action, quoted.

Affected products

VendorProductAffected versionsFixed
Palo Alto NetworksPAN-OS——

Why it's on these mode pages

  • Maritime: Vendor table: Palo Alto Networks (network and remote-access gear used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Palo Alto Networks (network and remote-access gear used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Palo Alto Networks (network and remote-access gear used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Palo Alto Networks (network and remote-access gear used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Palo Alto Networks (network and remote-access gear used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Palo Alto Networks (network and remote-access gear used in every mode, all modes) (matched by rule)

Change history

  1. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com