Palo Alto warns of critical firewall flaw, tells users a patch is on the way

Date:
Thu, 07 May 2026 14:05:00 +0000

Description:
Risks can be mitigated through settings, while Palo Alto works on a patch.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A critical buffer overflow flaw (CVE20260300) in PANOS UserID Authentication Portal is under limited exploitation The bug allows unauthenticated code execution with root privileges on exposed firewalls Palo Alto advised restricting portals to trusted networks; fixes are due May 13, 2026 PAN-OS User-ID Authentication Portal, a feature in Palo Alto Networks firewalls that identifies and authenticates users on a network, contains a critical-severity zero-day vulnerability which is being exploited in limited attacks, the company has warned.

The bug is described as a buffer overflow weakness that allows
unauthenticated threat actors to run arbitrary code with root privileges on PA-Series and VM-Series firewalls via specially crafted packets. It is
tracked as CVE-2026-0300 and was given a severity score of 9.3/10 (critical). It only works against endpoints that are exposed to the public internet. You may like Cisco warns of critical SD-WAN security flaw which has been open since 2023 Fortinet patches FortiGate Firewall vulnerabilities that allowed hackers to steal enterprise credentials BeyondTrust RCE flaw lets hackers run code without logging in Latest Videos From Guidance and patches "Limited exploitation has been observed targeting Palo Alto Networks User-ID Authentication Portals that are exposed to untrusted IP addresses and/or the public internet," Palo Alto explained in a security advisory.

"Customers following standard security best practices, such as restricting sensitive portals to trusted internal networks are at a greatly reduced
risk."

In a further statement shared with BleepingComputer , the company said the vulnerability was specific to a limited number of customers with their Authentication Portals exposed to the public internet, or untrusted IP addresses. We have observed limited exploitation of this issue and are
working to release software fixes, with the first updates expected to be available on May 13, 2026," the company told the publication.

"We have provided clear mitigation guidance to our customers to secure their environments immediately. This issue does not impact Cloud NGFW or Panorama appliances." Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

Users who are unsure if they are exposed or not can see if their firewalls
are configured to use the vulnerable service from the Settings page. They can navigate to Device - User Identification - Authentication Portal Settings - Enable Authentication Portal. Access to the portal should be restricted to trusted zones only, or even disabled, if possible, Palo Alto advised.

According to Shadowserver data, there are currently 5,800 PAN-OS VM-series firewalls exposed online. The majority are located in Asia (2,466), with a significant minority in North America (1,988). The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/palo-alto-warns-of-critical-firewall-fl aw-tells-users-a-patch-is-on-the-way


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)