Research · May 6, 2026 · ZeroDay Catalog
Critical Out-of-Bounds Write Vulnerability in Palo Alto Networks PAN-OS
A critical out-of-bounds write vulnerability has been identified in Palo Alto Networks PAN-OS, allowing potential unauthorized access and code execution.
What changed
Palo Alto Networks has disclosed a significant buffer overflow vulnerability within the User-ID™ Authentication Portal of PAN-OS. This flaw enables unauthenticated attackers to execute arbitrary code with root privileges on affected firewalls.
The vulnerability arises from the handling of specially crafted packets, which can lead to severe security implications if exploited.
Who is affected
The vulnerability primarily impacts the PA-Series and VM-Series firewalls running PAN-OS. Organizations utilizing these products should be aware of the risks associated with this issue.
Prisma Access, Cloud NGFW, and Panorama appliances are not affected by this vulnerability, providing some relief to users of these services.
- PA-Series firewalls by Palo Alto Networks
- VM-Series firewalls by Palo Alto Networks
- Organizations with exposed User-ID™ Authentication Portal services
What to do
To mitigate the risks associated with this vulnerability, it is crucial to restrict access to the User-ID™ Authentication Portal. Adhering to best practice guidelines can significantly reduce exposure.
Palo Alto Networks recommends limiting access to trusted internal IP addresses to enhance security.
- Review and implement access controls for the User-ID™ Authentication Portal.
- Regularly update PAN-OS to the latest version to incorporate security patches.
- Monitor network traffic for unusual activity related to the User-ID™ Authentication Portal.