Fixing and finding
Jump to remediation plan
CVE ID
CVE-2026-0300
Published 2026-05-06
Updated 3 months ago
Vendor/s
Palo Alto Networks
Product/s
PAN-OS
Version/s
10.2.0
KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog. Active
exploitation observed in the wild.
CVSS Score (v3.1)
9.8
/ 10
Critical
Severity Details
Base score
9.8 Critical
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Description
Critical RCE vulnerability (CVSS 9.8) in Palo Alto Networks PAN-OS User-ID portal. Actively exploited; affects PA-Series and VM-Series firewalls.
CPE
Palo Alto Networks
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| pan-os | 10.2.0 | 10.2.0 | vulnerable |
| pan-os | 10.2.1 | 10.2.1 | vulnerable |
| pan-os | 10.2.2 | 10.2.2 | vulnerable |
| pan-os | 10.2.3 | 10.2.3 | vulnerable |
| pan-os | 10.2.4 | 10.2.4 | vulnerable |
| pan-os | 10.2.5 | 10.2.5 | vulnerable |
| pan-os | 10.2.6 | 10.2.6 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.7 | 10.2.7 | vulnerable |
| pan-os | 10.2.8 | 10.2.8 | vulnerable |
| pan-os | 10.2.9 | 10.2.9 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.10 | 10.2.10 | vulnerable |
| pan-os | 10.2.11 | 10.2.11 | vulnerable |
| pan-os | 10.2.12 | 10.2.12 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.13 | 10.2.13 | vulnerable |
| pan-os | 10.2.14 | 10.2.14 | vulnerable |
| pan-os | 10.2.15 | 10.2.15 | vulnerable |
| pan-os | 10.2.16 | 10.2.16 | vulnerable |
| pan-os | 10.2.16 | 10.2.16 | vulnerable |
| pan-os | 10.2.16 | 10.2.16 | vulnerable |
| pan-os | 10.2.16 | 10.2.16 | vulnerable |
| pan-os | 10.2.17 | 10.2.17 | vulnerable |
| pan-os | 10.2.18 | 10.2.18 | vulnerable |
| pan-os | 10.2.18 | 10.2.18 | vulnerable |
| pan-os | 10.2.18 | 10.2.18 | vulnerable |
| pan-os | 11.1.0 | 11.1.0 | vulnerable |
| pan-os | 11.1.1 | 11.1.1 | vulnerable |
| pan-os | 11.1.2 | 11.1.2 | vulnerable |
| pan-os | 11.1.3 | 11.1.3 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.4 | 11.1.4 | vulnerable |
| pan-os | 11.1.5 | 11.1.5 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.6 | 11.1.6 | vulnerable |
| pan-os | 11.1.7 | 11.1.7 | vulnerable |
| pan-os | 11.1.7 | 11.1.7 | vulnerable |
| pan-os | 11.1.7 | 11.1.7 | vulnerable |
| pan-os | 11.1.7 | 11.1.7 | vulnerable |
| pan-os | 11.1.8 | 11.1.8 | vulnerable |
| pan-os | 11.1.9 | 11.1.9 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.10 | 11.1.10 | vulnerable |
| pan-os | 11.1.11 | 11.1.11 | vulnerable |
| pan-os | 11.1.12 | 11.1.12 | vulnerable |
| pan-os | 11.1.13 | 11.1.13 | vulnerable |
| pan-os | 11.1.13 | 11.1.13 | vulnerable |
| pan-os | 11.1.13 | 11.1.13 | vulnerable |
| pan-os | 11.1.13 | 11.1.13 | vulnerable |
| pan-os | 11.1.14 | 11.1.14 | vulnerable |
| pan-os | 11.2.0 | 11.2.0 | vulnerable |
| pan-os | 11.2.1 | 11.2.1 | vulnerable |
| pan-os | 11.2.2 | 11.2.2 | vulnerable |
| pan-os | 11.2.3 | 11.2.3 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.4 | 11.2.4 | vulnerable |
| pan-os | 11.2.5 | 11.2.5 | vulnerable |
| pan-os | 11.2.6 | 11.2.6 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.7 | 11.2.7 | vulnerable |
| pan-os | 11.2.8 | 11.2.8 | vulnerable |
| pan-os | 11.2.9 | 11.2.9 | vulnerable |
| pan-os | 11.2.10 | 11.2.10 | vulnerable |
| pan-os | 11.2.10 | 11.2.10 | vulnerable |
| pan-os | 11.2.10 | 11.2.10 | vulnerable |
| pan-os | 11.2.10 | 11.2.10 | vulnerable |
| pan-os | 11.2.10 | 11.2.10 | vulnerable |
| pan-os | 11.2.10 | 11.2.10 | vulnerable |
| pan-os | 11.2.11 | 11.2.11 | vulnerable |
| pan-os | 12.1.2 | 12.1.2 | vulnerable |
| pan-os | 12.1.3 | 12.1.3 | vulnerable |
| pan-os | 12.1.4 | 12.1.4 | vulnerable |
| pan-os | 12.1.4 | 12.1.4 | vulnerable |
| pan-os | 12.1.4 | 12.1.4 | vulnerable |
| pan-os | 12.1.5 | 12.1.5 | vulnerable |
| pan-os | 12.1.6 | 12.1.6 | vulnerable |
| pa-1410 | - | - | unaffected |
| pa-1420 | - | - | unaffected |
| pa-3410 | - | - | unaffected |
| pa-3420 | - | - | unaffected |
| pa-3430 | - | - | unaffected |
| pa-3440 | - | - | unaffected |
| pa-410 | - | - | unaffected |
| pa-410r | - | - | unaffected |
| pa-410r-5g | - | - | unaffected |
| pa-415 | - | - | unaffected |
| pa-415-5g | - | - | unaffected |
| pa-440 | - | - | unaffected |
| pa-445 | - | - | unaffected |
| pa-450 | - | - | unaffected |
| pa-450r | - | - | unaffected |
| pa-450r-5g | - | - | unaffected |
| pa-455 | - | - | unaffected |
| pa-455-5g | - | - | unaffected |
| pa-455r-5g | - | - | unaffected |
| pa-460 | - | - | unaffected |
| pa-501 | - | - | unaffected |
| pa-505 | - | - | unaffected |
| pa-510 | - | - | unaffected |
| pa-520 | - | - | unaffected |
| pa-540 | - | - | unaffected |
| pa-5410 | - | - | unaffected |
| pa-5420 | - | - | unaffected |
| pa-5430 | - | - | unaffected |
| pa-5440 | - | - | unaffected |
| pa-5445 | - | - | unaffected |
| pa-545-poe | - | - | unaffected |
| pa-5450 | - | - | unaffected |
| pa-550 | - | - | unaffected |
| pa-5540 | - | - | unaffected |
| pa-555-poe | - | - | unaffected |
| pa-5550 | - | - | unaffected |
| pa-5560 | - | - | unaffected |
| pa-5570 | - | - | unaffected |
| pa-5580 | - | - | unaffected |
| pa-560 | - | - | unaffected |
| pa-7500 | - | - | unaffected |
| pa-7500-dpc-a | - | - | unaffected |
| vm-100 | - | - | unaffected |
| vm-300 | - | - | unaffected |
| vm-50 | - | - | unaffected |
| vm-500 | - | - | unaffected |
| vm-700 | - | - | unaffected |
| ruggedcom_ape1808_firmware | - | - | vulnerable |
| ruggedcom_ape1808 | - | - | unaffected |
Related weakness (CWE)
CWE-787
Remediation plan
1
Apply official patches
Install the latest security updates released by Palo Alto Networks on May 13, 2026, which specifically address the memory corruption vulnerability in the User-ID Authentication Portal service.
2
Update affected systems
Ensure all PA-Series and VM-Series firewalls running vulnerable PAN-OS versions, including branches 10.2, 11.1, 11.2, and 12.1, are updated to the designated patched maintenance releases.
3
Restrict access
Immediately restrict access to the User-ID Authentication Portal (Captive Portal) to only trusted internal IP addresses or zones, and disable the service entirely if it is not required for your environment.
4
Monitor for exploitation
Review system logs for unusual crashes of the 'authd' process and monitor network traffic for anomalous, malformed packets directed at the Captive Portal service ports.
Detection Guidance
"Monitor for unexpected restarts or crashes of the 'authd' process on PAN-OS devices. Security teams should look for malformed HTTP requests or unusually large payloads targeting the User-ID Authentication Portal. Deploy network signatures that detect buffer overflow patterns in packets destined for the captive portal. Additionally, audit system logs for unauthorized root-level activity or suspicious shell commands originating from the firewall management plane."
References
Sources
NIST National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities (KEV)