CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-05-06Vulnerability

CVE-2026-0300

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

Properties

Euvd product
PAN-OS
Vulnerability name
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
First seen
2026-10-15T01:11:55+00:00
Cvss score
9.8
Epss score
0.31725
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-05-09
Euvd assigner
palo_alto
Retrieved at
2026-10-21T01:24:48+00:00
Exploited euvd since
2026-05-06T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2026-05-06
Score
9.8
Euvd base score version
4.0
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
Palo Alto Networks
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9.3

Related Entities (216 · showing 25)

AFFECTS_PRODUCT (211 · showing 20)

→[Product]cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*
→[Product]cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-445:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-460:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-410r:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-7500-dpc-a:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-510:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-410r-5g:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:vm-700:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-410:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-450:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-3430:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-540:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-5550:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-455r-5g:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-455-5g:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:o:paloaltonetworks:pan-os:12.1.5:-:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-5570:-:*:*:*:*:*:*:*
→[Product]cpe:2.3:h:paloaltonetworks:pa-5410:-:*:*:*:*:*:*:*

MENTIONED_IN (2)

→[Campaign]Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
→[Campaign]FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch

DESCRIBES (1)

←[KEVEntry]Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Out-of-bounds Write

INVOLVES (1)

←[Signal]kev_added · 2026-05-06

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-0300 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal