Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)
2026-05-06T19:23:54Z•c7b0d5d5f4cf687ca56a66bb85f08501de8cd0c4ceb7ddfad8825d840bee9514
CVE-2026-0300CVE-2026-31431CVE-2026-41940Chaos ransomwareCopy FailDWAgentLinux LPEMFA bypassMetasploitMuddyWaterPAN-OSPalo Alto NetworksRATUser-ID Authentication Portalauthentication bypassbuffer overflowcPanelcaptive portalexploited in the wildsocial engineeringunauthenticated RCE
What happened
This Rapid7 collection highlights multiple high‑impact vulnerabilities and notable threat research. Most prominently, CVE-2026-0300 is a critical, unauthenticated buffer overflow (CWE-787) in the PAN-OS User‑ID Authentication (Captive) Portal that allows remote arbitrary code execution as root (CVSSv4 9.3) and is confirmed exploited in the wild; Prisma Access, Cloud NGFW, and Panorama are not affected. Also covered: CVE-2026-41940, a critical cPanel & WHM authentication bypass (CVSS 9.8) allowing unauthenticated administrative access; and CVE-2026-31431 (“Copy Fail”), a public Linux local‑priv
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- c7b0d5d5f4cf687ca56a66bb85f08501de8cd0c4ceb7ddfad8825d840bee9514
- Enrichment time
- 2026-05-06T19:23:54Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.