Palo Alto Networks disclosed CVE-2026-0300 on May 6, 2026 — a critical (CVSS 9.3) buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal (Captive Portal service). The flaw allows an unauthenticated remote attacker to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted network packets to the portal's listening service.
CISA added CVE-2026-0300 to the Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of May 9 for federal agencies. No patch is available until May 13 at the earliest. Palo Alto confirmed active exploitation began as early as April 9, with successful root-level compromise observed approximately one week later. Shodan identifies roughly 225,000 internet-facing PAN-OS instances representing the potential attack surface.
The immediate workaround is to restrict or disable the User-ID Authentication Portal from internet-accessible or untrusted zones. Organizations that have not already audited their Captive Portal exposure must do so now. Prisma Access, Cloud NGFW, and Panorama are not affected.
◈ Table of Contents
Phase 1 — Background & Affected Products
CWE-787| Attribute | Detail |
|---|---|
| CVE ID | CVE-2026-0300 CRITICAL |
| CVSS Score | 9.3 (CVSS v4.0) — 8.7 if portal restricted to internal IPs only |
| CWE | CWE-787 — Out-of-bounds Write (Buffer Overflow) |
| Component | PAN-OS User-ID Authentication Portal (Captive Portal service), ports 6081/6082 |
| Attack Vector | Network — no authentication required, no user interaction, no special conditions |
| Impact | Unauthenticated remote code execution as root; full firewall compromise |
| Published | 2026-05-06 by Palo Alto Networks PSIRT |
| CISA KEV Added | 2026-05-06 · Action due 2026-05-09 for federal agencies |
| Exploit Maturity | ATTACKED (confirmed in-the-wild exploitation per NVD CVSS v4.0 metadata) |
| Not Affected | Prisma Access, Cloud NGFW, Panorama appliances |
Affected PAN-OS versions:
| PAN-OS Branch | Vulnerable Versions | Patch Target |
|---|---|---|
| 12.1 | Prior to 12.1.4-h5 and 12.1.7 | 12.1.4-h5 or 12.1.7 — est. May 13 |
| 11.2 | Prior to 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12 | 11.2.4-h17+ — est. May 13–28 |
| 11.1 | Prior to 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 | Hotfix releases — est. May 13–28 |
| 10.2 | Prior to 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 | Hotfix releases — est. May 28 |
Phase 2 — Exploitation Details
Root RCE ConfirmedPalo Alto Networks confirmed that active exploitation was first observed on April 9, 2026. Initial attempts were unsuccessful. Approximately one week later, attackers successfully achieved RCE against a targeted device and injected shellcode running with root privileges. The initial exploitation wave targeted internet-exposed Captive Portal configurations — specifically the User-ID Authentication Portal service listening on ports 6081 and 6082.
The vulnerability is classified as "Automatable: YES" in the NVD CVSS v4.0 metadata. This means scanning and exploitation can be scripted and run at scale. Threat actors with access to the exploit do not need to manually engage each target. Any internet-exposed Captive Portal is at immediate risk of automated compromise.
Phase 3 — Indicators of Compromise
Behavioral IOCsPalo Alto Networks has not published network-level IOCs (hashes, IPs, domains) associated with the in-the-wild exploitation at time of writing. The following behavioral indicators are derived from expected post-exploitation activity on a compromised PAN-OS device.
| Type | Indicator | Context |
|---|---|---|
| Network Port | 6081, 6082 (TCP/UDP) | Captive Portal service listening ports — unexpected inbound traffic from untrusted IP ranges signals potential exploitation attempts |
| Process Anomaly | Unexpected child processes spawned by pan_cli or sslvpn | Post-exploitation shellcode may spawn shell processes under these parent processes |
| File System | New files in /tmp, /var/tmp on PAN-OS device | Implants and staging files typically land in temp directories on compromised devices |
| Network Traffic | Outbound connections from firewall management IP to non-Palo Alto IPs | Compromised firewall beaconing to attacker C2 infrastructure |
| Auth Log | Multiple auth failures to Captive Portal from single source IP, followed by silence | Indicative of initial unsuccessful attempts followed by successful exploit |
Phase 4 — Detection & Hunt Queries
KQL / SPLPhase 5 — Mitigation & Patching
No Patch Until May 13- 1In PAN-OS: navigate to Device > User Identification > User-ID Agents and review which zones have Captive Portal enabled.
- 2Remove the Captive Portal from any zone that includes internet or untrusted IP ranges.
- 3If Captive Portal is not required for your environment, disable it entirely in Network > Network Profiles > Interface Mgmt.
- 4Verify ports 6081 and 6082 are not reachable from untrusted networks after the change.
- 1Track the patch release on security.paloaltonetworks.com. Subscribe to PSIRT notifications.
- 2Schedule maintenance windows for May 13–15 for 12.1 and 11.2 branches; May 28 window for 10.2 branch.
- 3Test hotfixes in staging/DR environments before applying to production perimeter firewalls.
CISA's required action for federal agencies (due May 9) is to apply workaround or discontinue use. For private sector: use the CISA timeline as a forcing function. If you have not disabled internet-facing Captive Portal by May 9, you are operating outside acceptable risk posture given confirmed in-the-wild exploitation and no available patch.
Phase 6 — MITRE ATT&CK Mapping
Network Perimeter| Technique | ID | Application to CVE-2026-0300 |
|---|---|---|
| Exploit Public-Facing Application | T1190 | Direct exploitation of the internet-exposed Captive Portal service via crafted packets |
| Exploitation for Privilege Escalation | T1068 | Buffer overflow grants root (uid=0) from initially unprivileged context |
| Network Device Compromise | T1584.008 | Compromising the firewall itself as a network device gives complete network visibility and lateral movement capability |
| Proxy: Internal Proxy | T1090.001 | Compromised firewall can be used as an internal network proxy to pivot to segmented resources |
| Modify System Image | T1601 | Root access enables persistent implant installation in PAN-OS system image for reboot persistence |
Phase 7 — Sources & References
8 sources🔍 CHECK YOUR EXPOSURE
Use the CyberHawk IOC Scanner to test whether your PAN-OS management IPs appear in threat actor reconnaissance data. If your Captive Portal was internet-exposed before today, assume it has been scanned.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."