Palo Alto Networks Discloses Critical PAN‑OS CVE‑2026‑0300 Exploitation Attempts
Patch PAN‑OS immediately to mitigate CVE‑2026‑0300.
Patch PAN‑OS immediately to mitigate CVE‑2026‑0300.
Summary
On 9 April 2026, Palo Alto Networks disclosed that threat actors had attempted to exploit a critical buffer‑overflow flaw in the User‑ID Authentication Portal service of PAN‑OS. The vulnerability, identified as CVE‑2026‑0300, carries a CVSS score of 9.3/8.7 and allows unauthenticated attackers to execute arbitrary code on affected firewalls. PAN‑OS versions that include the User‑ID Authentication Portal are potentially impacted, though Palo Alto has not yet listed specific releases. The flaw was discovered in early April, and the company has issued a patch to mitigate the risk. Users are urged to apply the update immediately to prevent exploitation. The incident underscores the importance of timely patching for critical infrastructure components.
Key changes
- CVE‑2026‑0300 is a buffer‑overflow in the User‑ID Authentication Portal service of PAN‑OS
- Unauthenticated attackers can exploit it to gain arbitrary code execution
- CVSS score is 9.3/8.7
- Threat actors attempted exploitation as early as April 9 2026
- Affected PAN‑OS versions are not yet specified but likely recent releases