Is CVE-2026-0300 exploited in the wild?

Yes. CVE-2026-0300 is known to be exploited in the wild, first recorded on 6 May 2026. Treat it as urgent.

How severe is CVE-2026-0300?

Critical severity, with a CVSS score of 9.8, published 6 May 2026.

Which products and versions are affected?

Siemens Ruggedcom Ape1808 All versions, All versions using affected PAN-OS Virtual NGFW.

Is there a fix for CVE-2026-0300?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-0300 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-0300?

Check whether you run Palo Alto Networks PAN-OS, Paloaltonetworks Pa-1410, Paloaltonetworks Pa-1420 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0300: Palo Alto Networks PAN-OS buffer overflow in User-ID Authentication Portal

CVE-2026-0300 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-05-06

Siemens RUGGEDCOM APE1808 devices are affected by a critical vulnerability in the integrated Palo Alto Networks PAN-OS software. This flaw exists in the User-ID Authentication Portal, a service used to manage user access to network resources. An unauthenticated attacker can exploit this to take full control of the device with root privileges, potentially leading to complete network compromise, data theft, or disruption of industrial operations.

Technologies: Palo Alto Networks PAN-OS, Siemens Ruggedcom Ape1808. Vendors: Palo Alto Networks, Paloaltonetworks, Siemens.

Quick answers

Is CVE-2026-0300 exploited in the wild?: Yes. CVE-2026-0300 is known to be exploited in the wild, first recorded on 6 May 2026. Treat it as urgent.
How severe is CVE-2026-0300?: Critical severity, with a CVSS score of 9.8, published 6 May 2026.
Which products and versions are affected?: Siemens Ruggedcom Ape1808 All versions, All versions using affected PAN-OS Virtual NGFW.
Is there a fix for CVE-2026-0300?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0300 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-0300?: Check whether you run Palo Alto Networks PAN-OS, Paloaltonetworks Pa-1410, Paloaltonetworks Pa-1420 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds write (CWE-787) located in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS, which is utilized by Siemens RUGGEDCOM APE1808 devices. The flaw is triggered by sending specially crafted packets to the affected service. Because the service runs with high privileges, a successful exploit allows an unauthenticated network-based attacker to execute arbitrary code with root permissions. Siemens is currently preparing fixes; in the interim, mitigations include disabling Response Pages on untrusted interfaces or restricting access to the Authentication Portal to trusted internal IP addresses.

Affected products

Siemens RUGGEDCOM APE1808 Devices All versions

Timeline

2026-05-12: advisory: Initial Siemens ProductCERT advisory (SSA-967325) published
2026-05-19: advisory: CISA republication of the advisory

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-02

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.