A buffer overflow in the User‑ID™ Authentication Portal, also known as the Captive Portal, allows an unauthenticated attacker to craft specially formatted packets that cause an overflow and execute arbitrary code with root privileges on Palo Alto Networks PA‑Series and VM‑Series firewalls. The flaw resides in the portal service and can be triggered without authentication, giving the attacker full control over the affected device.

The vulnerability affects Palo Alto Networks PA‑Series and VM‑Series firewalls running PAN‑OS. Prisma Access, Cloud NGFW, and Panorama appliances are not impacted by this issue. Access to the User‑ID™ Authentication Portal must be limited to trusted internal zones to mitigate the risk. No specific PAN‑OS version information is provided, so administrators should verify their installed firmware against the vendor’s release notes.

The CVSS score of 8.7 indicates high severity, and the vulnerability is listed in the CISA KEV catalog, signaling that it may be actively exploited. The EPSS score of 15% indicates a moderate to high probability of exploitation in the wild, underscoring the need for quick action. An attacker can exploit this flaw by sending malicious packets over any network path that reaches the User‑ID™ Authentication Portal; the attack vector is reported as network‑based from an unauthenticated source.