Vulnerability

CERT-In Vulnerability Note CIVN-2026-0226
Remote Code Execution Vulnerability in Palo Alto Networks PAN-OS

Original Issue Date:May 09, 2026

Severity Rating: CRITICAL

Software Affected

PAN-OS 12.1 versions prior to 12.1.4-h5 and 12.1.7
PAN-OS 11.2 versions prior to 11.2.4-h17, 11.2.7-h13, 11.2.10-h6 and 11.2.12
PAN-OS 11.1 versions prior to 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15
PAN-OS 10.2 versions prior to 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6

Overview

A critical vulnerability has been reported in Palo Alto Networks PAN-OS that may allow a unauthenticated remote attacker to execute arbitrary code with root privileges on the targeted system

Target Audience:
Organizations using PAN-OS based PA-Series and VM-Series firewalls.

Risk Assessment:
Critical risk of compromise of system integrity.

Impact Assessment:
Potential for complete system compromise.

Description

Palo Alto Networks PAN-OS is a network security operating system designed for PA-Series and VM-Series firewalls, providing enterprise-grade network security and threat prevention capabilities.

A vulnerability has been reported in the User-ID� Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS due to an out-of-bounds write condition leading to a buffer overflow. A remote attacker may exploit this vulnerability by sending specially crafted requests.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the targeted system.

Solution

Apply appropriate security updates as mentioned in:
https://security.paloaltonetworks.com/CVE-2026-0300

Vendor Information

Palo Alto
https://security.paloaltonetworks.com/

References

https://security.paloaltonetworks.com/CVE-2026-0300

CVE Name
CVE-2026-0300

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India