Product:
User-ID Authentication Portal
Summary
A buffer overflow vulnerability in the User-ID Authentication Portal service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if access to the User-ID Authentication Portal is secured by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW, and Panorama appliances are not impacted by this vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-0300 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted packets to the User-ID Authentication Portal service. Since the vulnerability allows for arbitrary code execution with root privileges, an unauthenticated attacker can gain full control over the affected firewalls, leading to potential data breaches and system compromise.
Affected Products
- PA-Series Firewalls: Vulnerable to buffer overflow leading to arbitrary code execution.
- VM-Series Firewalls: Also susceptible to the same buffer overflow vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to secure access to the User-ID Authentication Portal by following best practice guidelines. This includes restricting access to only trusted internal IP addresses, which significantly reduces the risk of exploitation.