DaystoPatch

Palo Alto NetworksExploited incident

PAN-OS User-ID Authentication Portal unauthenticated buffer overflow (zero-day)

CVE-2026-0300Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 6 May 2026

  • Exploited before a fix
FixedFixed for every supported version 23 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
7.7d
First public report to first fixUnverified source
Follow-through
23d
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0300 (advisory page)CuratedQuote not checked yet

    2026-05-05 Initial publication.

    Discovered in production (source 'USER'); the advisory already stated limited exploitation at first publication (Wayback 20260506003032). No earlier public report found. Time from this timeline entry's data-date attribute (2026-05-05T23:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    Bluesky postClaimedQuote not checked yet5 May 2026, 23:03 UTC

    Paloaltoの脆弱性情報 「CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal (Severity: CRITICAL)」が公開されました。

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-0300)ClaimedQuote verified6 May 2026

    Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

    Added to CISA's KEV catalog on 2026-05-06.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet6 May 2026, 08:14 UTC

    Palo Alto Networks Flaw Exploited for Remote Code Execution A critical vulnerability in Palo Alto Networks' PAN-OS software has been exploited, allowing hackers to execute malicious code with root

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-0300ClaimedQuote verified6 May 2026, 18:57 UTC

    A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2892c3c4ec354612…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0300 (advisory page)CuratedQuote not checked yet

    2026-05-05 Initial publication.

    Time from this timeline entry's data-date attribute (2026-05-05T23:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks advisory CVE-2026-0300 (Wayback snapshot 2026-05-06 00:30 UTC)CuratedQuote verified

    Disable User-ID™ Authentication Portal if not required.

    Mitigations (restrict the portal to trusted zones, or disable it) were in the initial advisory; time from the advisory timeline's initial publication (data-date). A Threat Prevention signature followed (timeline 2026-05-06T17:27Z).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4784c9ae2c569020…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2026-0300ClaimedQuote verified6 May 2026, 17:27 UTC

    Updated with Threat Prevention ID and clarified the Required Configuration section.

    CaveatRevision mentions a workaround or mitigation; it may have existed earlier.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d6ff0663ea04be6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  4. First fix

    +7.7dUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0300 (advisory page timeline)CuratedQuote not checked yet

    2026-05-13 Updated the release timeline and Solution table.

    At initial publication every fixed release carried an ETA (first batch 'ETA: 05/13'). The 05/13 batch (12.1.4-h5, 11.2.7-h13, 11.2.10-h6, 11.1.4-h33, 11.1.6-h32, 11.1.10-h25, 11.1.13-h5, 10.2.10-h36, 10.2.18-h6) shows no ETA in the 2026-05-28 snapshot; the same builds were listed as available in CVE-2026-0257's advisory published at 2026-05-13T16:00Z. Time from this timeline entry's data-date attribute (2026-05-13T16:00:00.000Z) on the same page. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Palo Alto Networks advisory CVE-2026-0300ClaimedQuote verified14 May 2026, 19:15 UTC

    Updated the Fix release timeline for 10.2.16-h7.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d6ff0663ea04be6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0300ClaimedQuote verified16 May 2026, 01:15 UTC

    Updated the Fix release timeline for 10.2.13-h21.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d6ff0663ea04be6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0300ClaimedQuote verified28 May 2026, 00:00 UTC

    Updated the Fix release timeline for 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d6ff0663ea04be6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +23d

    Palo Alto Networks advisory CVE-2026-0257 (CVE advisory timeline; same PAN-OS release)CuratedQuote verified

    2026-05-28 Updated the Fix release timeline for 12.1.7.

    Last branch fix needed for this CVE was 12.1.7 (for 12.1.5-12.1.6). This advisory's timeline records 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12 under '2026-05-28T00:00:00Z' (the 17:57Z snapshot that day still showed them with 'ETA: 05/28', so the midnight time is not real) and never records 12.1.7: its product table still read '>= 12.1.7 (ETA: 05/28)' on 2026-10-22. 12.1.7's release time is taken from the CVE-2026-0257 advisory, which tracks the same PAN-OS builds. Time from this timeline entry's data-date attribute (2026-05-28T21:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2026-0300ClaimedQuote verified28 May 2026, 00:00 UTC

    Updated the Fix release timeline for 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12.

    CaveatLast change-log entry that touches fixes; the advisory now lists fixes for every affected branch.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d6ff0663ea04be6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

This advisory changed after publication

  1. CVE-2026-0257

    Recorded in the revision history

    PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

    CVSS exploit maturity changed from unreported to attacked (displayed score 4.7 to 7.8). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 4 rows added and 4 rows removed. One new row reads "PAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7".

    • Severity
    • Exploitation status
    • Fixed versions
    CVSS exploit maturity
    Beforeunreported
    Afterattacked
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Version table rows
    BeforePAN-OS 12.1 | = 12.1.4-h6 (ETA: 05/18) >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h14 (ETA: 05/14) >= 11.2.10-h7 (ETA: 05/14) >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28
    AfterPAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7; PAN-OS 11.2 | = 11.2.4-h17 >= 11.2.7-h14 >= 11.2.10-h7 >= 11.2.12; PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15; PAN-OS 10.2 | = 10.2.7-h34 >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6
    Earlier version captured 14 May 2026, 07:06 UTC: archived copyLater version captured 31 May 2026, 07:00 UTC: archived copyRecovered from archived copiesSnapshots b630683187… and 2d5ed451df…Incident page

  2. CVE-2026-0300

    Recorded in the revision history

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    Version table: 1 row added and 1 row removed. One new row reads "PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.".

    • Fixed versions
    Version table rows
    BeforePAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 (ETA: 05/28) >= 10.2.16-h7 (ETA: 05/28) >= 10.2.18-h6
    AfterPAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    10-h6 >= 11.2.12 (ETA: 05/28) PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28) PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 (ETA: 05/28) >= 10.2.16-h7 (ETA: 05/28) >= 10.2.18-h6 Prisma Access | None | All Required Configuration for Exposure This issue is applicable only to PA-Series and VM-Series firewa

    After

    10-h6 >= 11.2.12 (ETA: 05/28) PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28) PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6 Prisma Access | None | All Required Configuration for Exposure This issue is applicable only to PA-Series and VM-Series firewalls that are configured to

    Earlier version captured 13 May 2026, 16:03 UTC: archived copyLater version captured 28 May 2026, 17:57 UTC: archived copyRecovered from archived copiesSnapshots e5e5e67760… and 8ed5f890fc…Incident page

  3. CVE-2026-0300

    Recorded in the revision history

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    Version table: 21 rows added and 4 rows removed. One new row reads "PAN-OS 12.1 | = 12.1.4-h5 >= 12.1.7 (ETA: 05/28)".

    • Fixed versions
    Version table rows
    BeforePAN-OS 12.1 | = 12.1.4-h5 (ETA: 05/13) >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h13 (ETA: 05/13) >= 11.2.10-h6 (ETA: 05/13) >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 (ETA: 05/13) >= 11.1.6-h32 (ETA: 05/13) >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 (ETA: 05/1
    AfterPAN-OS 12.1 | = 12.1.4-h5 >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h13 >= 11.2.10-h6 >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28); PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/
    Earlier version captured 10 May 2026, 21:16 UTC: archived copyLater version captured 13 May 2026, 16:03 UTC: archived copyRecovered from archived copiesSnapshots 256ee144ef… and e5e5e67760…Incident page

Send this to your boss

PAN-OS Authentication Portal zero-day: mitigations May 5, fixes May 13-28

Attackers exploited a PAN-OS buffer overflow in the User-ID Authentication Portal before any fix existed; fixes arrived in stages between 13 and 28 May 2026.

In plain words

Palo Alto Networks firewalls had a critical flaw in an optional login portal that attackers were exploiting before a fix existed. The vendor published workarounds on 5 May 2026 and fixed software between 13 and 28 May 2026. If our firewalls use this portal, we need to be on a fixed version and should check that the portal is not open to the internet.

What happened and who is affected

What happened

On 5 May 2026 Palo Alto Networks disclosed CVE-2026-0300, an unauthenticated out-of-bounds write in the User-ID Authentication Portal of PAN-OS firewalls, and said limited exploitation had been observed. No fixed releases existed yet, so the vendor told customers to restrict or disable the portal. The first fixed releases shipped on 13 May 2026 and the last (PAN-OS 12.1.7) on 28 May 2026.

Who is affected

PA-Series and VM-Series firewalls running PAN-OS 12.1, 11.2, 11.1 or 10.2 below the fixed hotfix for their train, with the User-ID Authentication Portal enabled. Cloud NGFW and Prisma Access are not affected.

CVE-2026-0300. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/palo-alto-networks-cve-2026-0300/

Affected products

  • PAN-OS (PA-Series and VM-Series firewalls with User-ID Authentication Portal)
How we built this timeline

Zero-day: exploitation stated at first publication (5 May 2026) and no fix until 13 May 2026. Staggered fixes per this advisory's timeline: 13 May 2026 (first batch), 10.2.16-h7 14 May 2026, 10.2.13-h21 16 May 2026, 11.1.15/11.1.7-h6/11.2.4-h17/11.2.12 on 28 May 2026 (timeline time 00:00Z, not credible to the minute). 10.2.7-h34 never gets its own entry here;

CVE-2026-0257's timeline dates it 20 May 2026. The advisory still shows a stale '12.1.7 (ETA: 05/28)' on 22 Oct 2026 although CVE-2026-0257 records 12.1.7 as released 28 May 2026; reviewer should double-check.

Severity: CVSS-BT/B 9.3 (CRITICAL).

Related

Palo Alto Networks report card