CVE-2026-0300: If your Palo Alto User-ID Authentication Portal is internet-exposed, lock it down now — patches start May 13
A critical PAN-OS zero-day, CVE-2026-0300, is being actively exploited but only when Palo Alto Networks’ User-ID Authentication Portal is reachable from untrusted networks. Patches begin rolling out on May 13, 2026; until your appliances are updated, restricting or disabling the portal is the practical defense that changes your immediate risk profile.
Portal-exposed versus default deployments: where the danger actually is
CVE-2026-0300 is a buffer‑overflow in the Captive Portal (User‑ID Authentication Portal) that allows unauthenticated remote root code execution on PA‑Series and VM‑Series firewalls. Exploitation requires the portal to be reachable from an untrusted network — the code path is triggered by specially crafted packets and needs no credentials or user interaction.
This is not a generic PAN‑OS flaw. Default, internal-only deployments are not affected; Prisma Access, Cloud NGFW, and Panorama appliances are explicitly unaffected. The real condition that turns this from theoretical to urgent is an internet‑facing or untrusted‑zone authentication portal.
Immediate steps that materially reduce your attack surface
The single fastest risk reduction is to limit portal reachability: configure the Authentication Portal to accept connections only from known, trusted internal IP ranges or disable the portal if it’s not required. Palo Alto’s console path to verify this is Device > User Identification > Authentication Portal Settings — check reachability and allowed IP lists now.
Additional practical controls: place the portal behind a strictly scoped management ACL, deny its listener from untrusted zones, and log or block anomalous packets aimed at the portal service. These controls cut exposure in ways that patching alone cannot accomplish while you wait for fixes.
Patch schedule, scope, and operational checkpoints
Palo Alto Networks has scheduled patches in two waves: the first set will be released on May 13, 2026, and follow‑ups on May 28. Fixes will cover PAN‑OS versions 10.2, 11.1, 11.2, and 12.1. Prioritize the versions you run and plan staged rollouts that allow for testing, because many shops will be updating widely deployed PA‑Series and VM‑Series firewalls.
Watch for these specific signals: (1) official patch availability and cumulative release notes on May 13/28, (2) adoption metrics from your asset inventory, and (3) any published IoCs or exploit samples. As of publication, Palo Alto has described exploitation as “limited” and has not published public IoCs; CISA has not yet added CVE‑2026‑0300 to its Known Exploited Vulnerabilities catalog.
Decision checkpoints and an action checklist
Decide using three binary checkpoints: is the Authentication Portal reachable from untrusted networks? Is your appliance covered by the May patches? Has the portal been disabled or restricted? Each “yes/no” changes what follow‑up you must do.
| Condition | Immediate action | Follow-up |
|---|---|---|
| Portal reachable from internet or untrusted zone | Restrict to trusted IPs or disable portal now | Apply May 13/28 patches, monitor logs for exploit attempts |
| Portal restricted to internal IPs only | Verify ACLs and network segmentation | Schedule patching per maintenance window |
| Prisma Access / Cloud NGFW / Panorama | No immediate action for this CVE | Continue normal patching cadence |
Quick Q&A
When are patches available? First wave on May 13, 2026, with additional fixes on May 28, covering PAN‑OS 10.2, 11.1, 11.2, and 12.1.
Are Panorama, Prisma Access, or Cloud NGFW affected? No — Palo Alto has stated these products are unaffected by CVE‑2026‑0300.
How do I confirm exposure? In the firewall UI check Device > User Identification > Authentication Portal Settings for listener address and allowed IP ranges; also review NAT/zone rules that might permit untrusted access.
Why this matters for infrastructure owners
Palo Alto firewalls are common at scale in critical infrastructure — the vendor reports roughly 70,000 customers and deployment across 90% of Fortune 10 — which makes an internet‑exposed portal a high‑value target. The current active exploitation, described as limited by Palo Alto, keeps this at the level of targeted intrusions rather than broad worming, but the impact of a successful RCE is high because it yields root privileges.
Your operational trade‑off is simple and immediate: accept transient operational limits (disable or restrict the portal) to avoid high-severity risk until you can apply the May patches and validate your environment. Track patch rollouts and any published IoCs as the next checkpoint for moving from emergency controls back to normal operations.
