Signal

Critical unauthenticated buffer overflow vulnerability exploited in Palo Alto Networks PAN-OS firewalls

Evidence first: scan the strongest sources, then decide whether to go deeper.

Published 2026-05-06 00:11 UTCUpdated 2026-05-06 13:31 UTC

rss

cveexploitssecurity_advisoryincident_response

Source links open

Source links and full evidence are open here. Pro adds archive history, compare-over-time, alerts, exports, and workflow. Business adds Feed API integrations and team usage.

Back Evidence (7)Get the free brief by email Start free trial

No card needed for the free brief.

Evidence trail (top sources)

top sources (4 domains)

4 top sources shown

Palo Alto Networks security advisory (AV26-425)

Gc · cyber.gc.ca · 2026-05-06 13:31 UTC

Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)

Rapid7 · rapid7.com · 2026-05-06 13:27 UTC

Root-level RCE vulnerability in Palo Alto firewalls exploited (CVE-2026-0300)

Helpnetsecurity · helpnetsecurity.com · 2026-05-06 09:51 UTC

2026-006: Critical Vulnerability in PAN-OS

Europa · cert.europa.eu · 2026-05-06 08:48 UTC

View all evidence

Overview

A critical buffer overflow vulnerability (CVE-2026-0300) affecting the User-ID Authentication Portal in Palo Alto Networks PAN-OS software is being actively exploited in the wild.

Entities

Palo Alto NetworksPAN-OSUser-ID Authentication Portal

Score total

1.98

Momentum 24h

Evidence documents

Independent publishers

Independent origins

Primary sources

Secondary sources

Source types

Duplicate ratio

Why now

Exploitation has been confirmed in the wild, targeting exposed Authentication Portals.
Patches are not yet available but expected starting May 13, 2026, requiring interim mitigations.
The vulnerability affects multiple PAN-OS versions and firewall models, broadening the impact scope.

Why it matters

The vulnerability allows unauthenticated remote attackers to execute code with root privileges, risking full firewall compromise.
Palo Alto Networks firewalls are widely deployed in enterprise networks, making this a significant security risk.
Active exploitation in the wild increases urgency for patching and mitigation to prevent breaches.

LLM analysis

Topic mix: lowPromo risk: lowSource quality: high

Recurring claims

CVE-2026-0300 is a critical unauthenticated buffer overflow vulnerability in Palo Alto PAN-OS User-ID Authentication Portal allowing remote root code execution.

How sources frame it