CVE-2026-0300: 
PAN-OS vulnerability analysis and mitigation

CVE-2026-0300 is a critical buffer overflow (out-of-bounds write) vulnerability in the User-ID™ Authentication Portal (also known as Captive Portal) service of Palo Alto Networks PAN-OS software. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. The vulnerability was discovered internally by Palo Alto Networks' Deep Product Security Research Team and was first published on May 5, 2026, with active exploitation confirmed at the time of disclosure. Affected versions span PAN-OS 10.2.x (before specific hotfixes), 11.1.x (before specific hotfixes), 11.2.x (before specific hotfixes), and 12.1.x (before specific hotfixes); Prisma Access, Cloud NGFW, and Panorama appliances are not affected. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (PAN Advisory, CISA KEV).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), a classic stack or heap buffer overflow condition in the Captive Portal service process. An attacker sends specially crafted network packets to the User-ID Authentication Portal interface, triggering an out-of-bounds memory write that corrupts adjacent memory and enables control-flow hijacking to achieve arbitrary code execution as root. Exploitation requires no authentication, no user interaction, and no special privileges — the only precondition is that the User-ID Authentication Portal is enabled and accessible (i.e., an interface management profile with Response Pages enabled is attached to an L3 interface reachable from untrusted networks). Multiple public proof-of-concept repositories have been published on GitHub, including scripts targeting the buffer overflow offset and demonstrating RCE mechanics (PAN Advisory, PoC GitHub, PoC GitHub).

Successful exploitation grants an unauthenticated attacker full root-level code execution on the affected PA-Series or VM-Series firewall, resulting in complete compromise of confidentiality, integrity, and availability of the device. An attacker with root access to a perimeter firewall can intercept, modify, or drop all network traffic traversing the device, pivot into internal network segments, exfiltrate sensitive data, implant persistent backdoors, or disable security controls entirely. The Earthworm malware family has been observed weaponizing this vulnerability, and approximately 5,800 internet-exposed firewalls were identified as potentially vulnerable at the time of disclosure (PAN Advisory, SecureBulletin, SecPod).

CVE-2026-0300 was being actively exploited in the wild as a zero-day prior to patch availability, with exploitation observed as early as April 9, 2026 — nearly a month before public disclosure on May 5–6, 2026. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on May 6, 2026, with a remediation due date of May 9, 2026 (CISA KEV). Multiple public PoC exploit scripts are available on GitHub, including at least two assessed as functional exploit code targeting unauthenticated RCE. The EPSS score is approximately 0.144 (14.4%). Exploitation has been attributed to a suspected state-sponsored threat cluster designated CL-STA-1132, bearing hallmarks of Chinese state-sponsored hacking, and the Earthworm tunneling malware has been linked to exploitation activity (SecurityWeek, SecPod, BleepingComputer).

1. Reconnaissance: Use Shodan, Censys, or FOFA to identify internet-facing Palo Alto Networks PA-Series or VM-Series firewalls with the User-ID Authentication Portal (Captive Portal) exposed on a public interface. Filter for PAN-OS versions in the affected ranges (10.2.x, 11.1.x, 11.2.x, 12.1.x).
2. Verify exposure: Confirm the target has the Captive Portal response page accessible by sending HTTP/HTTPS requests to the management interface or L3 interface with Response Pages enabled. Tools like the diagnostic scanner at panos_cve_2026_0300_diag.py can fingerprint exposure without sending exploit payloads.
3. Craft malicious packet: Construct a specially crafted network packet targeting the User-ID Authentication Portal service. Public PoC scripts (e.g., research_poc.py) accept parameters such as --target, --port, and --offset (buffer overflow offset) to build the payload.
4. Trigger buffer overflow: Send the crafted packet to the Captive Portal endpoint on the target firewall. The out-of-bounds write corrupts memory in the portal service process, overwriting the return address or function pointer with attacker-controlled data.
5. Achieve root code execution: The overwritten control-flow data redirects execution to attacker-supplied shellcode or a ROP chain, resulting in arbitrary OS command execution with root privileges on the firewall.
6. Post-exploitation: Deploy persistent implants (e.g., Earthworm tunneling tool), establish reverse shells or C2 channels, exfiltrate firewall configuration and credentials, and pivot into internal network segments accessible through the compromised perimeter device (PAN Advisory, Unit 42, BleepingComputer).

• Network: Unusual or malformed HTTP/HTTPS requests to the Captive Portal (User-ID Authentication Portal) interface from untrusted or external IP addresses; unexpected outbound connections from the firewall management plane to unknown external IPs; traffic patterns consistent with Earthworm tunneling tool (e.g., SOCKS proxy traffic over non-standard ports).
• Logs: PAN-OS system logs showing crashes or restarts of the authd or User-ID portal service process; authentication portal access logs with anomalous packet sizes or malformed headers from external sources; Threat Prevention logs triggering Threat ID 510019 (if Threat Prevention subscription is active with content version 9097-10022 or later).
• File System: Unexpected new files or binaries in firewall writable directories; presence of Earthworm (ew) tunneling binary or similar lateral movement tools; unauthorized SSH keys added to root's authorized_keys.
• Process: Unexpected child processes spawned by the Captive Portal service (e.g., shell interpreters, network utilities like curl, wget, nc); unusual listening ports opened by non-standard processes on the firewall.
• Configuration: Unauthorized changes to firewall policy rules, administrator accounts, or VPN configurations following the exploitation window (PAN Advisory, Unit 42, SecPod).

Palo Alto Networks has released patched versions across all affected branches. Organizations should upgrade to the following fixed versions or later: PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6; PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15; PAN-OS 11.2: 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, or 11.2.12; PAN-OS 12.1: 12.1.4-h5 or 12.1.7. For organizations unable to patch immediately, two workarounds are available: (1) restrict User-ID Authentication Portal access to only trusted internal IP zones and disable Response Pages in the Interface Management Profile on any L3 interface reachable from untrusted networks; or (2) disable the User-ID Authentication Portal entirely if not required. Organizations with a Threat Prevention subscription can also enable Threat ID 510019 (content version 9097-10022 or later, requires PAN-OS 11.1+) to block known exploit attempts (PAN Advisory, CISA KEV).

Palo Alto Networks disclosed the vulnerability on May 5–6, 2026, acknowledging active exploitation and crediting its internal Deep Product Security Research Team along with Unit 42 and Xpanse ILI for threat intelligence support. Unit 42 published a dedicated threat brief on the Captive Portal zero-day exploitation campaign (Unit 42). CISA issued an alert and added the CVE to its KEV catalog the same day as disclosure, setting an aggressive 3-day remediation deadline (May 9, 2026) for federal agencies (CISA KEV). Security researchers and media widely covered the state-sponsored attribution angle, with SecurityWeek, The Register, and BleepingComputer reporting on the Chinese state-hacking campaign hallmarks and the nearly month-long exploitation window before disclosure (SecurityWeek, BleepingComputer). The community reaction on Reddit and social media was significant, with practitioners expressing concern about the pre-patch exploitation window and the exposure of approximately 5,800 internet-facing firewalls. Multiple honeypot repositories were created within hours of disclosure to detect exploitation attempts.