Skip to content

KEV: PAN-OS User-ID Authentication Portal out-of-bounds write (CVE-2026-0300)

Signal: CISA KEV catalog version 2026.05.06 added CVE-2026-0300 for Palo Alto Networks PAN-OS on 2026-05-06 with a due date of 2026-05-09.

Advisory covered

  • Palo Alto Networks PAN-OS out-of-bounds write — CVE-2026-0300 affects PAN-OS User-ID Authentication Portal exposure. CISA's required action says to apply vendor mitigations, follow cloud-service guidance where applicable, or discontinue use if mitigations are unavailable. Until an official fix is available, CISA calls out two workarounds: restrict User-ID Authentication Portal access to trusted zones only, or disable User-ID Authentication Portal if it is not required.

References: Palo Alto advisory, NVD, CISA KEV.

Why this is urgent

KEV inclusion means known exploitation. The short CISA due date indicates this should be treated as an active edge-device exposure problem, not a routine patch backlog item. Firewalls and authentication portals sit on high-value network boundaries; compromise can become credential theft, policy manipulation, internal pivoting, or loss of visibility.

Immediate triage

  1. Inventory PAN-OS devices and identify any User-ID Authentication Portal exposure, especially internet-facing or untrusted-zone access.
  2. Apply vendor mitigations immediately; if no fixed version is available for the deployment, restrict portal access to trusted zones or disable the portal when not required.
  3. Pull management, system, threat, authentication, and traffic logs before making changes if compromise is plausible.
  4. Hunt for unexpected portal requests, crashes/restarts, configuration changes, new admin accounts, disabled logging, unusual User-ID mappings, and connections from the device to internal assets.
  5. Rotate credentials that traversed the portal or were stored on affected appliances if suspicious activity is found.

Durable controls

  • Keep management and authentication portals off untrusted networks unless there is a documented business need and compensating access control.
  • Place edge-device emergency mitigations into a runbook with owner, exposure check, log-preservation step, and rollback plan.
  • Monitor for KEV additions separately from vendor patch feeds; exploited edge devices need a faster SLA.
  • Treat network-security appliances as privileged systems: configuration integrity, admin MFA, log forwarding, and out-of-band backup matter as much as patching.