Palo Alto 820 - Software Update for CVE-2026-0300

[Netzer]

Hi there,

I'm trying to patch the current secruity waring for CVE-2026-0300, but it is not clear to me which software version will fix the problem.

My current system is on 11.1.10-h10 (PA-820 cluster).

The official document from PA can be found here: https://security.paloaltonetworks.com/CVE-2026-0300

The versions in the product table which would fix the problem, don't appear in my panorama's update list.

So which one will fix the problem?

Any hint?

thx

Daniel

[reaper · Accepted solution]

Hi @Netzer 

Right now there is no fix available yet. You'll need to apply remediation as suggested in the article under "Workarounds and Mitigations" until a PANOS hotfix is available (expected dates are also listed in the article)

[johnlinkowsky]

Does anyone know what PA (unique) threat ID for this?  I checked the Threat Vault, but it says it "has not been reviewed yet" - so no ID attached.  I updated my threat signatures, etc., but would like to filter/monitor on if I see any threats associated with this CVE.  Thank you. 

[rwilkins]

This is a follow up question for anyone that has more knowledge of captive portals than me but does CVE-2026-300 also effect captive portals that are configured in transparent mode?

[chrise_coh]

According to this morning's emergency content update email, the Threat ID is 510019.  It was the only change listed for version 9097.

Also, why is this feature on by default?  Having an open listener on a port for a service that isn't required is a poor security practice.  Surely it can be turned on IF someone decides to use Global Protect?  Or are there other functions that needs the captive portal enabled?  We probably need to recheck our own best practices and firewall build process, but again, why is this even on by default?