CVE · Exploited · On CISA KEV

CVE-2026-0300

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

9.8: CVSS 3.1
1: story
MAY 6: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Palo Alto Networks
Product: PAN-OS
Published: May 6, 2026
Added to KEV: May 6, 2026
KEV deadline: May 9, 2026
Ransomware use: Unknown
Weakness: CWE-787

What it is

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

MAY 6
VulnerabilitiesPalo Alto CVE-2026-0300 Actively ExploitedPAN released an advisory about the vulnerability on Tuesday and said it will release a patch in an upcoming version of PAN-OS.DENNIS FISHER · 1 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixsecurity.paloaltonetworks.com/CVE-2026-0300 Analysiscert-portal.siemens.com/productcert/html/ssa-967325.html