{"cve_id":"CVE-2026-0300","published":"2026-05-06T19:16:35.730000+00:00","last_modified":"2026-10-26T19:10:00.163000+00:00","vuln_status":"Analyzed","description":"A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. \n\nThe risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the  best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail  by restricting access to only trusted internal IP addresses.\n\nPrisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":9.8,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-787"],"in_kev":true,"kev_date_added":"2026-05-06","kev_ransomware":false,"epss_score":0.41714,"epss_percentile":0.98686,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-10-28T03:32:47.957127+00:00","first_seen":"2026-05-06T19:16:35.730000+00:00","kev_first_seen":"2026-05-06T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["paloaltonetworks","siemens"],"products":["pa-1410","pa-1420","pa-3410","pa-3420","pa-3430","pa-3440","pa-410","pa-410r","pa-410r-5g","pa-415","pa-415-5g","pa-440","pa-445","pa-450","pa-450r","pa-450r-5g","pa-455","pa-455-5g","pa-455r-5g","pa-460","pa-501","pa-505","pa-510","pa-520","pa-540","pa-5410","pa-5420","pa-5430","pa-5440","pa-5445","pa-545-poe","pa-5450","pa-550","pa-5540","pa-555-poe","pa-5550","pa-5560","pa-5570","pa-5580","pa-560","pa-7500","pa-7500-dpc-a","pan-os","ruggedcom_ape1808","ruggedcom_ape1808_firmware","vm-100","vm-300","vm-50","vm-500","vm-700"],"affected":[{"vendor":"paloaltonetworks","product":"pan-os","ranges":["11.2.8","11.2.9","11.2.10","11.2.11","12.1.2","12.1.3","12.1.4","12.1.5","10.2.0","12.1.6","10.2.1","10.2.2","10.2.3","10.2.4","10.2.5","10.2.6","10.2.7","10.2.8","10.2.9","10.2.10","10.2.11","10.2.12","10.2.13","10.2.14","10.2.15","10.2.16","10.2.17","10.2.18","11.1.0","11.1.1","11.1.2","11.1.3","11.1.4","11.1.5","11.1.6","11.1.7","11.1.8","11.1.9","11.1.10","11.1.11","11.1.12","11.1.13","11.1.14","11.2.0","11.2.1","11.2.2","11.2.3","11.2.4","11.2.5","11.2.6","11.2.7"]},{"vendor":"siemens","product":"ruggedcom_ape1808_firmware","ranges":["all versions"]}]}