CVE-2026-0300 Palo Alto Networks PAN-OS Buffer Overflow Overview & Takeaways

CVE-2026-0300: a buffer overflow in PAN-OS User-ID Authentication Portal (CVSS 9.3) allows unauthenticated root RCE, with limited in-the-wild exploitation of exposed instances; patching advised.

In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.

Our effort on this began in earnest in the last quarter of 2019. Today we are beginning to publish the root cause analyses for 0-days exploited in the wild that we have completed. While we’re publishing some in bulk now to play “catch-up”, in the future we plan to post each one in a timely manner after it’s detected and disclosed. We think publishing technical details in a timely manner is important for transparency and so that the whole of the security community can make informed decisions and actions.

I’m really interested in 0-days exploited in the wild and what we, the security community, can learn about them to make 0-day hard. I explained some of Project Zero’s ideas and goals around in-the-wild 0-days in a November blog post.

Analysis of four Palo Alto PAN-OS firewall vulnerabilities: authenticated command injection (CVE-2020-2037, CVE-2020-2038), unauthenticated denial of service (CVE-2020-2039) and reflected XSS (CVE-2020-2036) — each able to leak data, disrupt components or expose internal segments.

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.