CVE-2026-0300: Palo Alto Networks Cloud NGFW, грешка в паметта

Описание

Оригинално описание

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Засегнати продукти

• Palo Alto Networks Cloud NGFW: All
• Palo Alto Networks PAN-OS: 12.1.0 преди 12.1.7; 11.2.0 преди 11.2.12; 11.1.0 преди 11.1.15; 10.2.0 преди 10.2.18-h6
• Palo Alto Networks Prisma Access: All
• Siemens RUGGEDCOM APE1808: всички версии

Вид слабост

• CWE-787 Out-of-bounds Write

История

Други уязвимости в Palo Alto Networks Cloud NGFW

• 9.2CVE-2026-111497
• 9.2CVE-2026-109619
• 9.2CVE-2026-109618
• 1.1CVE-2026-0316
• 1.2CVE-2026-0317

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-0300
• https://nvd.nist.gov/vuln/detail/CVE-2026-0300
• https://security.paloaltonetworks.com/CVE-2026-0300
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300
• https://cert-portal.siemens.com/productcert/html/ssa-967325.html