Palo Alto Networks warns of exploited PAN-OS Captive Portal flaw giving root access

Palo Alto Networks disclosed CVE-2026-0300 in early May 2026, a buffer overflow in the User-ID Authentication Portal (also called Captive Portal) service of PAN-OS, SecurityWeek reported on May 6. An unauthenticated attacker can send crafted packets to run code with root privileges. The company said it had seen limited exploitation targeting portals exposed to untrusted IP addresses or the public internet, and a May 8 update said the evidence appeared to point to China. PA-Series and VM-Series firewalls using the portal are affected; Prisma Access, Cloud NGFW and Panorama are not. Patches were scheduled in two rounds, May 13 and May 28.

Root-level code execution on a perimeter firewall gives an attacker control of the device that inspects and routes your traffic. Limited, targeted exploitation of this kind is often the work of well-resourced groups, and those campaigns tend to widen once technical details circulate.

Ask your firewall administrator or managed security provider three questions. First, is the User-ID Authentication Portal enabled on any of your firewalls? Second, is it reachable from the internet or other untrusted networks? Palo Alto says restricting it to trusted internal IP addresses significantly reduces risk. Third, has the fixed PAN-OS release for your version been installed? Request confirmation by device rather than a general assurance.

If the portal was exposed before patching, a compromise review is reasonable, not just an upgrade. This is a separate issue from earlier GlobalProtect advisories, so prior patching work does not cover it.

Sources

1.SecurityWeek ↗securityweek.com

Vendor in this insight

Palo Alto Networks

Palo Alto Networks is an $8B+ cybersecurity company (NASDAQ: PANW) providing enterprise-grade firewalls, Prisma SASE/cloud security, and Cortex XDR/XSIAM security operations. Multiple Gartner Magic Quadrant Leader designations (firewalls, SSE, endpoint). Cortex achieved FedRAMP High authorization (first AI-driven SOC platform to do so). Cortex Cloud holds both FedRAMP High AND Moderate — the only CNAPP with both. Unit 42 provides HIPAA assessments for healthcare organizations. Built-in PCI DSS, HIPAA, and GDPR compliance templates. All hardware firewalls assembled in the US (Texas). Serves 80,000+ customers including most of the Fortune 100.

View vendor profile

Does this affect your business?

Our advisors can help you figure out the right move, at no cost.

Talk to an advisor

Palo Alto Networks warns of exploited PAN-OS Captive Portal flaw giving root access

More on Network Security

SonicWall SMA 1000 hit by a third wave of exploited flaws in four months

Citrix NetScaler ADC and Gateway hit by two rounds of exploited flaws since August

CISA lists exploited MikroTik router and Sangoma Switchvox phone system flaws