Skip to content
Weekly Signal
Live intelligence Updated 21 Aug 2026 · 22:11 UTC

Palo Alto Networks, Paloaltonetworks, Siemens · PAN-OS, Pan-os, Ruggedcom Ape1808 Firmware

CVE-2026-0300

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Recommended action

Validate affected assets and exposure now, then remediate on an accelerated schedule. Palo Alto Networks Security advisory CVE-2026-0300

View response plan
CVSS9.3
EPSS32.1%
KEVYes
ExploitationConfirmed exploitation
RemediationNot yet verified ↓

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 32.1%; technical severity is CVSS 9.3.

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Who should care

  • Teams operating PAN-OS, Pan-os, Ruggedcom Ape1808 Firmware
  • Vulnerability and exposure management teams
  • Security operations teams monitoring exploitation activity

Response plan

What I would do

  1. Confirm whether PAN-OS, Pan-os, Ruggedcom Ape1808 Firmware is present in the environment.
  2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
  3. Palo Alto Networks Security advisory CVE-2026-0300
  4. Review relevant security telemetry for evidence of attempted or successful exploitation.
  5. Document the remediation decision and track it to verified completion.

Treatment intelligence

Remediation intelligence

Not yet verified

Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.

Verification noteAutomated link verification has not completed for this guidance yet.

Advisory

Required Action

Technical details

CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red
CWE
CWE-787
Affected versions
Palo Alto Networks PAN-OS; Paloaltonetworks Pan-os (Version 10.2.0 | Version 10.2.1 | Version 10.2.2 | Version 10.2.3); Siemens Ruggedcom Ape1808 Firmware (Version -)
Fixed versions
No explicit fixed version is currently recorded.
Published
6 May 2026
Attack vector
Network
Privileges required
None
User interaction
None

Signal timeline

  1. CVE published
  2. Added to CISA KEV
  3. Latest EPSS score: 32.1%
  4. Signal calculated at 76

External references

Live public intelligence This assessment combines public-source evidence. Validate the affected product, version and exposure against your own environment before making a risk decision.