{"uuid": "70373397-fafd-4846-a9d8-5f127b2e33ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0300", "type": "seen", "source": "https://t.me/Noheartz1337/386", "content": "\u203c\ufe0f\ud83d\udea8 CRITICAL: Palo Alto Networks has disclosed CVE-2026-0300, a buffer overflow in PAN-OS that is already being exploited in the wild.\n\nCVSS 4.0 score: 9.3.\n\nUnauthenticated attackers can hit the User-ID Authentication Portal (the Captive Portal service) with crafted packets and pop a root shell on the firewall. \n\nThe flaw is an out-of-bounds write (CWE-787) in PA-Series and VM-Series firewalls. Prisma Access, Cloud NGFW, and Panorama are not affected. The vulnerability only triggers when the User-ID Authentication Portal is enabled and reachable from untrusted networks.\n\nAffected branches:\n\n- PAN-OS 10.2 below 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6\n- PAN-OS 11.1 below 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15\n- PAN-OS 11.2 below 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12\n- PAN-OS 12.1 below 12.1.4-h5, 12.1.7\n\nPatches roll out between May 13 and May 28, 2026. A Threat Prevention signature for PAN-OS 11.1 and above shipped on May 5.\n\nMitigations before patches roll out:\n\n- Restrict Authentication Portal access to trusted internal IPs only\n- Disable the User-ID Authentication Portal entirely if not needed\n\nCompromising a perimeter firewall as root opens the door to lateral movement, traffic interception, credential harvesting, and full network takeover. Audit Device > User Identification > Authentication Portal Settings and treat any internet-exposed portal as an emergency.\n\nhttps://security.paloaltonetworks.com/CVE-2026-0300", "creation_timestamp": "2026-09-22T05:00:04.387970Z"}