Palo Alto Reports Active PAN-OS Vulnerability Exploitation

Palo Alto Networks announced on May 6, 2026, that attackers are actively exploiting a critical vulnerability in its PAN-OS software, urging customers to apply mitigations immediately while patches are developed.

Tracked as CVE-2026-3000, the flaw is a buffer overflow in the User-ID Authentication Portal, also known as the Captive Portal. This feature identifies users for traffic that firewalls cannot automatically map to specific identities. Unauthenticated attackers can send specially crafted packets to execute arbitrary code with root privileges on affected PA-Series and VM-Series firewalls configured to use the portal, according to the company's advisory. Prisma Access, Cloud NGFW, and Panorama appliances are not impacted.

"Limited exploitation has been observed targeting Palo Alto Networks User-ID Authentication Portals that are exposed to untrusted IP addresses and/or the public internet," the company stated. Customers who restrict access to trusted internal networks face greatly reduced risk, Palo Alto Networks added. Administrators can check their configuration under Device > User Identification > Authentication Portal > Settings to see if the portal is enabled.