VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 09:41 UTC
← Dashboard

CVE-2026-0300

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially…

Read full description
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
CVSS 9.3 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
1.8/10
REALITY · THREAT PRIORITY
8.6/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.3: +1.40
  • Fresh EPSS: 41.71%: +0.21

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 26 documents and public datasets.

Hype components

Headline sample (25%)
60/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
0/100
HYPE TOTAL18/100

Sources and documents

Pasquale Pillitteri
Press · 15 Oct 2026, 07:00 · Palo Alto PAN-OS zero-day CVE-2026-0322 exploited, patch now - Pasquale Pillitteri
Recorded Future
Press · 08 Sep 2026, 07:00 · August 2026 CVE Landscape - Recorded Future
Rapid7
Press · 14 May 2026, 07:00 · CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS - Rapid7
flyingpenguin
Press · 13 May 2026, 07:00 · Palo Alto Defender’s Guide Refutes Mythos Claim - flyingpenguin
Arctic Wolf
Press · 09 May 2026, 07:00 · Recommendations for CVE-2026-0300 - Arctic Wolf
See all 26 source documents
SecurityWeek
Press · 07 May 2026, 07:00 · Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking - SecurityWeek
Security Affairs
Press · 07 May 2026, 07:00 · Nation-state actors exploit Palo Alto PAN-OS zero-day for weeks - Security Affairs
BleepingComputer
Press · 07 May 2026, 07:00 · Palo Alto Networks firewall zero-day exploited for nearly a month - BleepingComputer
Security Affairs
Press · 07 May 2026, 07:00 · U.S. CISA adds a flaw in Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities catalog - Security Affairs
SC Media
Press · 07 May 2026, 07:00 · Palo Alto Networks says patch for exploited PAN-OS firewall bug forthcoming - SC Media
Help Net Security
Press · 07 May 2026, 07:00 · State-sponsored hackers likely behind zero-day attacks on Palo Alto firewalls - Help Net Security
The Hacker News
Press · 07 May 2026, 07:00 · PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage - The Hacker News
CyberSecurityNews
Press · 07 May 2026, 07:00 · CISA Warns of Palo Alto PAN-OS Vulnerability Exploited to Gain Root Access - CyberSecurityNews
SecurityWeek
Press · 06 May 2026, 07:00 · Palo Alto Networks to Patch Zero-Day Exploited to Hack Firewalls - SecurityWeek
Unit 42
Press · 06 May 2026, 07:00 · Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution - Unit 42
GBHackers News
Press · 06 May 2026, 07:00 · Critical Palo Alto Firewall Vulnerability Enables Attackers to Gain Root Privileges - GBHackers News
CyberSecurityNews
Press · 06 May 2026, 07:00 · Critical Palo Alto Firewalls Vulnerability Exploited in the Wild to Gain Root Access - CyberSecurityNews
The Hacker News
Press · 06 May 2026, 07:00 · Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution - The Hacker News
CyberScoop
Press · 06 May 2026, 07:00 · A critical Palo Alto PAN-OS zero-day is being exploited in the wild - CyberScoop
wiz.io
Press · 06 May 2026, 07:00 · Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild - wiz.io
Rapid7
Press · 06 May 2026, 07:00 · Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300) - Rapid7
watchTowr
Press · 06 May 2026, 07:00 · Rapid Reaction: Palo Alto PAN-OS Buffer Overflow Vulnerability (CVE-2026-0300) - watchTowr
Help Net Security
Press · 06 May 2026, 07:00 · Root-level RCE vulnerability in Palo Alto firewalls exploited (CVE-2026-0300) - Help Net Security
BleepingComputer
Press · 06 May 2026, 07:00 · Palo Alto Networks warns of firewall RCE zero-day exploited in attacks - BleepingComputer
Security Affairs
Press · 06 May 2026, 07:00 · Palo Alto Networks PAN-OS flaw exploited for remote code execution - Security Affairs
SOC Prime
Press · 05 May 2026, 07:00 · CVE-2026-0300: Palo Alto PAN-OS Zero-Day Enables Root RCE on Exposed Firewalls - SOC Prime

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 1.8 · reality 8.6 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

4

Public exploit entries / repo candidates

See 4 repos with metrics
RepositoryStarsForksLanguageUpdated
p3Nt3st3r-sTAr/CVE-2026-0300-POC2211Python07 May 2026, 12:41
matad0r-maghribi/CVE-2026-0300-PANOS40Python06 May 2026, 14:25
qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC30Python06 May 2026, 05:37
sam00/POC-CVE-2026-0300-exploit00Python06 Aug 2026, 13:12
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.3; EPSS 41.7%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:48.680808+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
05 May 2026, 07:00
Added to the CISA KEV catalog
06 May 2026, 00:00
Published
06 May 2026, 18:57
Latest press mention
15 Oct 2026, 07:00
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
4 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar