Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution

Palo Alto Networks alert: CVE-2026-0300 is a critical buffer overflow in the PAN-OS User-ID Authentication (Captive Portal) service allowing unauthenticated attackers to execute arbitrary code as root on PA-Series and VM-Series firewalls. The flaw (CVSS up to 9.3) has seen limited exploitation in the wild, affects multiple PAN-OS 10.2–12.1 branches, is unpatched at the time of reporting with fixes scheduled from May 13, 2026, and organizations are advised to restrict or disable the portal until patches are applied.