Palo Alto Networks Warns of Critical Firewall Zero-Day Exploit Used in Attacks
Palo Alto Networks Issues Urgent Advisory on Firewall Vulnerability Exposed to Attacks
A critical, unpatched vulnerability has been identified in the Palo Alto Networks User-ID Authentication Portal, which is a security feature that authenticates users whose identities cannot be automatically mapped by the firewall.
Vulnerability Overview
The weakness, tracked as CVE-2026-0300, stems from a buffer overflow issue that allows unauthorized attackers to execute arbitrary code with root privileges on Internet-exposed PA-Series and VM-Series firewalls via specially crafted packets.
Risk Assessment
Limited exploitation has been observed targeting Palo Alto Networks User-ID Authentication Portals that are exposed to untrusted IP addresses and/or the public internet. However, customers who follow standard security best practices, such as restricting sensitive portals to trusted internal networks, are at a significantly reduced risk.
Action Required
The Palo Alto Networks User-ID Authentication Portal is a component of the PAN-OS operating system, which is widely used by enterprises and organizations to manage network traffic and enforce security policies. As part of its security features, the User-ID Authentication Portal provides a mechanism for administrators to authenticate users and assign access controls based on user identity.
Current Status
At present, there are over 5,800 PAN-OS VM-series firewalls exposed online, with the majority located in Asia and North America. The company has emphasized the importance of taking immediate action to mitigate the vulnerability, advising customers to restrict access to the User-ID Authentication Portal or disable it altogether if feasible.
Previous Incidents
This is not the first time Palo Alto Networks firewalls have been targeted by attackers. Recent incidents have highlighted the need for vigilance and proactive measures to prevent exploitation of zero-day vulnerabilities.
Palo Alto Networks Response
In response to these threats, Palo Alto Networks is working to address the current vulnerability and provide patches to affected customers as soon as possible.
Recommendations
The company strongly advises customers to take steps to secure their User-ID Authentication Portals by implementing additional security measures, such as restricting access to trusted zones or disabling the portal if necessary. By taking proactive steps, customers can minimize the risk of exploitation and protect their networks against potential threats.
Conclusion
As the cybersecurity landscape continues to evolve, it is essential for organizations to stay informed about emerging threats and vulnerabilities. By prioritizing security and staying up-to-date with the latest patches and updates, organizations can reduce the risk of successful attacks and maintain a robust defense posture.