Skip to content

Back to the catalog

Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild | Wiz Blog
wiz.ioadvisory

Critical Buffer Overflow Vulnerability in PAN-OS Exploited in-the-Wild | Wiz Blog

Wiz details CVE-2026-0300, a CVSS 9.3 buffer overflow in PAN-OS's User-ID Authentication Portal (Captive Portal, ports 6081/6082) that lets unauthenticated attackers trigger an out-of-bounds write and achieve remote code execution with root privileges. Palo Alto Networks has confirmed limited in-the-wild exploitation against internet-exposed instances; Wiz reports 7% of environments have publicly exposed PAN-OS and Shodan shows 67 exposed servers on port 6081. Guidance includes patching once fixes ship, restricting the Authentication Portal to trusted networks, and disabling it if unused.

TL;DR Unauthenticated buffer overflow RCE (CVE-2026-0300, CVSS 9.3) in PAN-OS's User-ID Authentication Portal is being actively exploited when exposed to the internet.
Open original ↗

Organisations named here

  • Palo Alto Networks

CVEs named here

  • CVE-2026-0300

Technologies named here

  • Palo Alto Networks PAN-OS
  • Wiz Threat Intel Center
  • Shodan
  • Wiz
  • CVSS

Techniques named here

  • Out-of-bounds write via crafted network packets

Related in AppSec