Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution

Palo Alto Networks has released a critical security advisory for CVE-2026-0300, a buffer overflow vulnerability in PAN-OS software that enables unauthenticated remote code execution.

• •The vulnerability affects PA-Series and VM-Series firewalls running PAN-OS versions 12.1, 11.2, 11.1, and 10.2, with varying patch versions required for each branch
• •An unauthenticated attacker can execute arbitrary code with root privileges by sending specially crafted packets to the User-ID Authentication Portal
• •The CVSS score is 9.3 if the portal is internet-accessible, or 8.7 if restricted to trusted internal networks
• •Active limited exploitation has been observed, particularly targeting publicly exposed User-ID Authentication Portal instances
• •