Palo Alto Networks

Palo Alto Networks warns of exploited PAN-OS Captive Portal flaw giving root access

Palo Alto Networks disclosed CVE-2026-0300 in early May 2026, a buffer overflow in the User-ID Authentication Portal (also called Captive Portal) service of PAN-OS, SecurityWeek reported on May 6. An unauthenticated attacker can send crafted packets to run code with root privileges. The company said it had seen limited exploitation targeting portals exposed to untrusted IP addresses or the public internet, and a May 8 update said the evidence appeared to point to China. PA-Series and VM-Series firewalls using the portal are affected; Prisma Access, Cloud NGFW and Panorama are not. Patches were scheduled in two rounds, May 13 and May 28. Root-level code execution on a perimeter firewall gives an attacker control of the device that inspects and routes your traffic. Limited, targeted exploitation of this kind is often the work of well-resourced groups, and those campaigns tend to widen once technical details circulate. Ask your firewall administrator or managed security provider three questions. First, is the User-ID Authentication Portal enabled on any of your firewalls? Second, is it reachable from the internet or other untrusted networks? Palo Alto says restricting it to trusted internal IP addresses significantly reduces risk. Third, has the fixed PAN-OS release for your version been installed? Request confirmation by device rather than a general assurance. If the portal was exposed before patching, a compromise review is reasonable, not just an upgrade. This is a separate issue from earlier GlobalProtect advisories, so prior patching work does not cover it.