Root-Level Remote Code Execution in PAN-OS Firewalls

Historical catalog analysis: CISA added this entry on May 06, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-0300 is an out-of-bounds write vulnerability (CWE-787) located within the User-ID Authentication Portal—also known as the Captive Portal—service of Palo Alto Networks PAN-OS. This flaw allows an unauthenticated attacker to send specially crafted packets to the affected service, which could result in the execution of arbitrary code with root privileges on the device.

Exposure and applicability

This vulnerability affects both PA-Series (hardware) and VM-Series (virtualized) firewalls running PAN-OS. In a healthcare environment, these devices often serve as the primary perimeter defense or as internal segmentation gateways that isolate electronic Protected Health Information (ePHI) from less secure network zones. Because the flaw allows for root-level access without authentication, a successful exploit could potentially bypass network security controls intended to protect clinical systems and patient data.

Remediation priorities

Based on our analysis of the vulnerability’s impact on healthcare operational resilience, we suggest the following prioritized actions:

1. Immediate Access Restriction: For organizations unable to patch immediately, restrict access to the User-ID Authentication Portal to only trusted network zones. This is a preventative control intended to reduce the likelihood of initial access from untrusted or external sources.
2. Service Deactivation: If the Captive Portal functionality is not required for clinical or administrative operations, disabling the service entirely removes the attack vector. This should be coordinated with network teams to ensure no disruption to legitimate user authentication workflows.
3. Patch Deployment: Apply the vendor patches released on May 13, 2026. Patching is the primary method for addressing the underlying memory corruption flaw.

How to validate remediation

To verify that exposure has been reduced, security leaders and network administrators should employ the following methods:

• Configuration Audit: Review firewall policy settings to confirm that the User-ID Authentication Portal is either disabled or restricted to specific, authorized IP ranges/zones.
• Version Verification: Confirm that the running PAN-OS version matches the patched releases provided by Palo Alto Networks as of May 13, 2026.

Note: A version check confirms a patch is installed but does not guarantee total immunity from all potential threats to the device.

Limits and open questions

While the vulnerability allows for root-level execution, it remains unknown whether this flaw has been utilized in active ransomware campaigns. Additionally, while CISA established a remediation deadline of May 9, 2026, for federal agencies, private healthcare providers must determine their own patching cadence based on their specific risk profile and HIPAA Security Rule obligations. There is residual risk if the Captive Portal remains enabled and accessible to untrusted zones prior to the application of the official patches.

Source and editorial note

CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability · Source date: May 06, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 09, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 10, 2026 at 01:04 UTC.

Request a healthcare security assessment