KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-0300
9.8
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityPalo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
VendorPalo Alto Networks
ProductPAN-OS
Date added2026-05-06
Due date2026-05-09
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
CWECWE-787
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
NVD: A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-06-12 16:00 UTC
Wall time120.0s
Searches8
Component defaultno
Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-0300
https://security.paloaltonetworks.com/CVE-2026-0300
https://unit42.paloaltonetworks.com/captive-portal-zero-day/
https://github.com/qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC
https://github.com/0xBlackash/CVE-2026-0300
https://github.com/ridhinva/CVE-2026-0300-PANOS-RCE
https://github.com/shizuku198411/CVE-2026-0300
https://github.com/bannned-bit/cve-2026-0300-panos
https://github.com/im-hanzou/CVE-2026-0300
https://github.com/riteshekbote/CVE-2026-0300-POC
https://github.com/ByteWraith1/CVE-2026-0300
https://www.rapid7.com/blog/post/etr-critical-buffer-overflow-in-palo-alto-networks-pan-os-user-id-authentication-portal-cve-2026-0300/
https://www.wiz.io/blog/critical-vulnerability-in-pan-os-exploited-in-the-wild-cve-2026-0300
https://labs.cloudsecurityalliance.org/research/csa-research-note-panos-cve-2026-0300-active-rce-20260513-cs/
https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-0300-palo-alto-networks-pan-os-buffer-overflow-overview-takeaways/
https://arcticwolf.com/resources/blog/cve-2026-0300/
https://www.helpnetsecurity.com/2026/05/06/palo-alto-firewalls-vulnerability-exploited-cve-2026-0300/
https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-4116.html
https://cert-portal.siemens.com/productcert/html/ssa-967325.html
https://security.paloaltonetworks.com/CVE-2026-0300
https://unit42.paloaltonetworks.com/captive-portal-zero-day/
https://github.com/qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC
https://github.com/0xBlackash/CVE-2026-0300
https://github.com/ridhinva/CVE-2026-0300-PANOS-RCE
https://github.com/shizuku198411/CVE-2026-0300
https://github.com/bannned-bit/cve-2026-0300-panos
https://github.com/im-hanzou/CVE-2026-0300
https://github.com/riteshekbote/CVE-2026-0300-POC
https://github.com/ByteWraith1/CVE-2026-0300
https://www.rapid7.com/blog/post/etr-critical-buffer-overflow-in-palo-alto-networks-pan-os-user-id-authentication-portal-cve-2026-0300/
https://www.wiz.io/blog/critical-vulnerability-in-pan-os-exploited-in-the-wild-cve-2026-0300
https://labs.cloudsecurityalliance.org/research/csa-research-note-panos-cve-2026-0300-active-rce-20260513-cs/
https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-0300-palo-alto-networks-pan-os-buffer-overflow-overview-takeaways/
https://arcticwolf.com/resources/blog/cve-2026-0300/
https://www.helpnetsecurity.com/2026/05/06/palo-alto-firewalls-vulnerability-exploited-cve-2026-0300/
https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-4116.html
https://cert-portal.siemens.com/productcert/html/ssa-967325.html
QC notes
warn component_extraction: Component 'Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) - nginx-hosted web service listening on TCP ports 6081 (transparent mode) and 6082 (redirect mode). Affects PA-Series and VM-Series firewalls running PAN-OS 10.2.x, 11.1.x, 11.2.x, and 12.1.x (specific hotfix versions listed in preconditions). The buffer overflow (CWE-787) occurs in the nginx worker process when processing specially crafted HTTP requests. Prisma Access, Cloud NGFW, and Panorama appliances are NOT affected.' matches or contains product name 'PAN-OS' — no specific component identified
Hunting hypothesis agent
Hunt for anomalous UDP traffic to PAN-OS Captive Portal ports 6081/6082 on PA/VM-Series firewalls indicating buffer overflow attempts by state-sponsored actors targeting nginx worker processes.
Research details
ComponentPalo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) - nginx-hosted web service listening on TCP ports 6081 (transparent mode) and 6082 (redirect mode). Affects PA-Series and VM-Series firewalls running PAN-OS 10.2.x, 11.1.x, 11.2.x, and 12.1.x (specific hotfix versions listed in preconditions). The buffer overflow (CWE-787) occurs in the nginx worker process when processing specially crafted HTTP requests. Prisma Access, Cloud NGFW, and Panorama appliances are NOT affected.
PreconditionsExploitation requires two configuration conditions on PA-Series or VM-Series firewalls: (1) The User-ID Authentication Portal (Captive Portal) must be explicitly enabled via Device > User Identification > Authentication Portal Settings (Enable Authentication Portal checkbox, in either transparent or redirect mode). (2) An Interface Management Profile with Response Pages enabled must be attached to any L3 interface in a zone where untrusted or internet traffic can ingress. The vulnerable nginx-hosted service listens on TCP ports 6081 (transparent mode) and 6082 (redirect mode). The vulnerability is a CWE-787 out-of-bounds write triggered by specially crafted HTTP/HTTPS packets sent to these ports, processed without adequate length validation by the nginx worker process. The portal service runs with root privileges. Successful exploitation yields arbitrary code execution with root privileges. The CL-STA-1132 state-sponsored campaign demonstrated post-exploitation deployment of EarthWorm and ReverseSocks5 tunneling tools, Active Directory enumeration via stolen firewall service account credentials, and systematic log destruction. Prisma Access, Cloud NGFW, and Panorama appliances are NOT affected. Affected PAN-OS versions: 10.2 (before 10.2.7-h34/10.2.10-h36/10.2.13-h21/10.2.16-h7/10.2.18-h6), 11.1 (before 11.1.4-h33/11.1.6-h32/11.1.7-h6/11.1.10-h25/11.1.13-h5/11.1.15), 11.2 (before 11.2.4-h17/11.2.7-h13/11.2.10-h6/11.2.12), 12.1 (before 12.1.4-h5/12.1.7). Patches released beginning May 13, 2026. Threat Prevention signature Threat ID 510019 available for PAN-OS 11.1+. agent
Deliveryspecially crafted HTTP/HTTPS packets (malformed POST request fields) sent to the User-ID Authentication Portal listening on TCP ports 6081 (transparent mode) or 6082 (redirect mode)
Public PoCyes
PoC URLs
https://github.com/qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC
https://github.com/0xBlackash/CVE-2026-0300
https://github.com/ridhinva/CVE-2026-0300-PANOS-RCE
https://github.com/shizuku198411/CVE-2026-0300
https://github.com/bannned-bit/cve-2026-0300-panos
https://github.com/im-hanzou/CVE-2026-0300
https://github.com/riteshekbote/CVE-2026-0300-POC
https://github.com/ByteWraith1/CVE-2026-0300 Third-party repos; verify before use.
https://github.com/0xBlackash/CVE-2026-0300
https://github.com/ridhinva/CVE-2026-0300-PANOS-RCE
https://github.com/shizuku198411/CVE-2026-0300
https://github.com/bannned-bit/cve-2026-0300-panos
https://github.com/im-hanzou/CVE-2026-0300
https://github.com/riteshekbote/CVE-2026-0300-POC
https://github.com/ByteWraith1/CVE-2026-0300 Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8 v3 / 9.3 v4) | Exploitation is automatable (no authentication, no user interaction required) | Active state-sponsored exploitation (CL-STA-1132) confirmed by Unit 42 | Multiple public PoCs exist on GitHub targeting the buffer overflow with crafted HTTP POST requests on ports 6081/6082
SummaryCVE-2026-0300 is a critical (CVSS 9.3) unauthenticated buffer overflow (CWE-787) in the PAN-OS User-ID Authentication Portal (Captive Portal) nginx service on TCP ports 6081/6082. Requires the portal enabled with Response Pages on an untrusted L3 interface. Actively exploited by the CL-STA-1132 state-sponsored cluster (April 2026) using EarthWorm/ReverseSocks5. Multiple public PoCs exist on GitHub. Patches available from Palo Alto Networks (May 13, 2026); Threat Prevention signature ID 510019 available for PAN-OS 11.1+.
Tia coverage
First reported2026-05-06
First exploit report2026-05-06
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
palo-alto-networks-pan-os-zero-day-cve-2026-0300-unauthenticated
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.