Vulnerabilities
Critical PAN-OS Buffer Overflow (CVE‑2026‑0300) Enables Root‑Level Code Execution
Palo Alto Networks has disclosed a 9.3‑scored buffer overflow in the User‑ID Authentication Portal of PAN‑OS that lets an unauthenticated attacker run arbitrary code with root privileges on PA‑Series and VM‑Series firewalls. Affected firmware spans versions before 12.1.4‑h5, 12.1.7, 11.2.4‑h17, and several earlier releases. No patch is live yet, but Palo Alto will ship one soon. Until then, limit or disable the captive portal. Immediate update is urged to shut the door on this critical flaw.
Palo Alto Networks just issued a critical advisory (CVE‑2026‑0300) that could let attackers hijack PA‑Series and VM‑Series firewalls with full root access. The flaw is a classic buffer overflow in the User‑ID Authentication Portal (captive portal) service.
What’s at Stake
Unauthenticated traffic can be crafted to overflow the portal’s buffer, spawning a shell that runs with root privileges. Palo Alto has seen limited exploitation in the wild, but the risk is high enough to warrant immediate action.
Affected Products
- PA‑Series & VM‑Series firewalls using the User‑ID Authentication Portal
- Versions prior to 12.1.4‑h5, 12.1.7, 11.2.4‑h17, 11.2.7‑h13, 11.2.10‑h6, 11.2.12, 11.1.4‑h33, 11.1.6‑h32, 11.1.7‑h6, 11.1.10‑h25, 11.1.13‑h5, 11.1.15, 10.2.7‑h34, 10.2.10‑h36, 10.2.13‑h21, 10.2.16‑h7, 10.2.18‑h6
How to Protect Now
- Restrict captive‑portal traffic to trusted zones only.
- Disable the User‑ID Authentication Portal if it’s not required.
- Apply the upcoming patch as soon as it becomes available.
“Patching is the only definitive fix. Until then, limit or disable the portal to block the attack surface.”
Next Steps
Keep an eye on the Palo Alto advisory for the patch release date. Once the fix lands, reboot the affected appliances to ensure the new firmware takes effect. Monitor logs for any suspicious authentication portal traffic.
Related vulnerabilities
Cisco RoomOS USB Driver Flaw Lets Local Attacker Gain Root Privileges
A buffer‑overflow bug in Cisco’s RoomOS USB driver allows a physically‑present attacker to execute arbitrary code as root. The issue arises from missing boundary checks on USB data. Cisco has released patches; no workarounds are available.
Read briefing
Critical RCE in Cisco Nexus 9000 Silicon One – Unauthenticated Remote Code Execution via Open Ports 43210/43211
Cisco has disclosed a critical remote code execution flaw in the Silicon One integration on its Nexus 9000 Series switches. The vulnerability, CVE‑2026‑20212, exposes TCP ports 43210 and 43211 in the default L3 VRF, allowing any unauthenticated attacker to send crafted packets that execute as root and can even crash the S1HAL process, forcing a device reload. Cisco has issued patches and workarounds; administrators should update immediately to mitigate the risk.
Read briefing
Tencent Sogou Input Method RCE Enables GrayRabbit Deployment by China‑Aligned Threat Actors
A critical one‑click remote code execution flaw (CVE‑2026‑51990) in Tencent’s Sogou Input Method for Windows has been weaponised by the UNC3569 group to drop the modular GrayRabbit backdoor. The exploit chains three weaknesses: an unvalidated URI handler, unrestricted Chromium‑based navigation, and an old, unsandboxed browser engine. Although Tencent released a patch that tightens URL validation and limits navigation, the underlying browser remains vulnerable. The incident underscores the need for timely updates and stricter sandboxing in third‑party input tools.
Read briefing
Dual Critical Flaws in Ivanti Sentry Enable Unauthenticated RCE and Admin Account Creation
CERT‑EU has exposed two zero‑day weaknesses in Ivanti Sentry appliances. CVE‑2026‑10520 is an OS command injection that can be leveraged for root‑level remote code execution, while CVE‑2026‑10523 allows attackers to bypass authentication and create arbitrary administrative accounts. All Sentry releases up to 10.7.0 are affected. Immediate patching is required to avoid exploitation.
Read briefing