Two PAN-OS vulnerabilities were confirmed exploited within weeks of each other in early-to-mid 2026, both scoring in the critical range and both touching the parts of Palo Alto Networks' firewall software that face the internet directly: the GlobalProtect VPN portal and gateway, and the User-ID Authentication Portal used for captive-portal-style access control.
| CVE | CVSS | Component | Added to KEV | Ransomware use |
|---|---|---|---|---|
| CVE-2026-0300 | 9.8 | User-ID Authentication Portal (Captive Portal) | 6 May 2026 | Unknown |
| CVE-2026-0257 | 9.1 | GlobalProtect portal and gateway | 29 May 2026 | Known |
Why a firewall vendor's own products are a favored initial-access target
Firewalls occupy a structurally unusual position in enterprise security: they are simultaneously the control that's supposed to stop external attackers and a piece of internet-facing software with its own vulnerability surface. CVE-2026-0300 is a stack-based buffer overflow in the User-ID Authentication Portal — NVD's description is direct that this "can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets." Root-level remote code execution on a firewall doesn't just compromise one host; it compromises the device making trust decisions for every packet traversing the network boundary, with no authentication required to trigger it and reachable by any attacker who can send packets to the portal.
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway, explicitly confirmed for known ransomware use per CISA's KEV entry. NVD describes it as allowing "the attacker to bypass security restrictions and establish an unauthorized VPN connection" — meaning a threat actor doesn't need to steal or guess a credential at all; the authentication check itself can be bypassed. For a ransomware operator, a working VPN foothold established this way is functionally equivalent to possessing valid stolen credentials, except it leaves none of the anomalous-login telemetry that a credential-based intrusion typically generates, since there was no login to be anomalous — the gate simply didn't check.
Why these two bugs deserve to be tracked as a pair, not independently
Both vulnerabilities target the two front doors PAN-OS exposes to remote users: GlobalProtect for VPN-based remote access, and the Authentication Portal for network-level captive-portal authentication. An organization that patches one path while leaving the other exposed has addressed only half of PAN-OS's confirmed-exploited attack surface for this period. Palo Alto's own advisory for CVE-2026-0300 notes that Panorama and Cloud NGFW are not affected — the same carve-out appears in the CVE-2026-0257 advisory — which narrows the affected population to on-premises PA-Series and VM-Series appliances specifically, but that population still represents a large share of enterprise firewall deployments.
What to check this week
Patch both CVE-2026-0300 and CVE-2026-0257 together, treating them as a single remediation sprint against PAN-OS's remote-access surface rather than two separate tickets prioritized independently.
Apply the interim workaround for CVE-2026-0300 if patching isn't immediately possible: restrict User-ID Authentication Portal access to trusted zones only, or disable the Captive Portal service entirely if it isn't required — both are explicitly listed in CISA's required action for this CVE.
Review GlobalProtect VPN connection logs for anomalies predating patch deployment, given CVE-2026-0257's confirmed ransomware association — an authentication bypass that established a connection without a valid login won't show up as a failed-login pattern, so look instead for VPN sessions with no corresponding successful authentication event in the identity provider's own logs.
Confirm which of your deployments are PA-Series or VM-Series appliances versus Panorama or Cloud NGFW, since the latter two are explicitly out of scope for both CVEs and don't need to be included in this specific remediation effort.
A closing note on captive portal and VPN portal exposure
Both of these components exist specifically to authenticate remote or on-network users before granting further access, which makes a flaw in either one a direct hit against the security boundary those components were built to enforce — not a peripheral feature bug, but a failure in the core function of the affected component.
A final consideration on firewall vendor risk concentration
Perimeter security vendors carry a structurally higher consequence-per-vulnerability than most software categories, since a single bug in a firewall's authentication or portal logic can undo the protection the entire device is deployed to provide — a fact that argues for faster-than-average patch cycles specifically for firewall and VPN gateway software, independent of any single CVE's raw severity score.
How Safeguard helps
Safeguard's continuous inventory flags internet-facing firewall and VPN infrastructure for expedited review, recognizing that vulnerabilities in the devices meant to enforce network boundaries carry consequences well beyond their own host and warrant faster remediation timelines than typical internal software findings.
