CVE-2026-0300: PAN-OS Unauthenticated RCE — Root Access via Authentication Portal Buffer Overflow

Palo Alto Networks confirmed on May 6, 2026 that CVE-2026-0300 — a critical buffer overflow in PAN-OS — is under active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal remediation deadline of May 9. Patches were not expected until May 13 at the earliest, leaving defenders with a narrow window to apply mitigations.

Vulnerability Overview

CVE-2026-0300 is a stack-based buffer overflow in the User-ID Authentication Portal (also referred to as the Captive Portal) service of PAN-OS software. When an unauthenticated attacker sends a specially crafted packet to the portal endpoint, the PAN-OS process fails to properly validate input length, resulting in a controllable stack overflow that allows execution of arbitrary shellcode with root privileges.

Affected hardware: PA-Series and VM-Series firewalls running PAN-OS 10.1, 10.2, 11.0, and 11.1. CVSS v4.0: 9.3 (Critical) if the portal is exposed to the internet or an untrusted network; 8.7 (High) if restricted to trusted internal IPs only.

Attack Chain

Exploitation is unauthenticated and requires only network access to the Authentication Portal. Observed attack flow:

1. Attacker enumerates the internet for PAN-OS User-ID Authentication Portal
   (typically TCP/443 with a distinctive TLS handshake fingerprint)

2. Craft oversized payload targeting the affected service buffer:
   POST /php/login.php HTTP/1.1
   Host: <firewall-ip>
   Content-Type: application/x-www-form-urlencoded
   Content-Length: <oversized>

   user=<shellcode-prefixed-overflow>&passwd=...

3. On successful overflow, shellcode is injected into an nginx worker process
   running as root

4. Observed post-exploitation: reverse shell callbacks to attacker C2,
   credential harvesting from the management plane, lateral movement to
   internal network segments behind the firewall

Threat actors made unsuccessful exploitation attempts as early as April 9, 2026 — a full 27 days before CISA's KEV listing. Successful RCE was achieved approximately one week after first attempts, around April 16.

IOCs

# Known scanning/exploitation source IPs (as of May 14, 2026)
45.141.87.204
91.92.243.115
185.220.101.47
194.165.16.98

# User-Agent observed in exploit attempts
Mozilla/5.0 (compatible; PAN-OS Exploit/1.0)

# YARA — Shellcode stub seen in memory dumps
rule PAN_CVE_2026_0300_shellcode {
  strings:
    $s1 = { 48 31 C0 48 31 FF 48 31 F6 48 31 D2 }
    $s2 = "nginx worker" nocase
  condition:
    all of them
}

Affected Versions

PAN-OS 10.1: < 10.1.14-h6  (fix: 10.1.14-h6)
PAN-OS 10.2: < 10.2.11-h4  (fix: 10.2.11-h4)
PAN-OS 11.0: < 11.0.6-h1   (fix: 11.0.6-h1)
PAN-OS 11.1: < 11.1.5      (fix: 11.1.5)

Remediation

Patch: Palo Alto began releasing fixes on May 13, 2026. Update immediately to the relevant fixed version above.

If patching is not immediately possible, apply the following workaround:

# Option 1: Restrict User-ID Authentication Portal to trusted IPs only
# This reduces CVSS from 9.3 to 8.7 but does NOT eliminate risk
# In Panorama / PAN-OS web UI:
# Network -> Network Profiles -> Interface Mgmt -> Restrict Auth Portal access

# Option 2: Disable Authentication Portal entirely if not in use
# Device -> User Identification -> User-ID -> Disable Authentication Portal

# Verify portal exposure from the CLI:
show system info | match "auth-portal"
show running security-policy | match "captive-portal"

# Check for signs of compromise:
grep -i "nginx" /var/log/pan/pan.log | grep "segfault\|overflow\|core dump"
show log system | match "critical\|error" direction equal forward

Detection

Splunk:
  index=panos sourcetype=pan:threat
  | search event_id=40000 OR "Authentication Portal"
  | where bytes_sent > 65536
  | stats count by src_ip, dst_ip

Elastic/ECS:
  event.dataset: pan.threat AND network.bytes: >65536
  AND destination.port: 443

Sigma rule: github.com/SigmaHQ/sigma — rule_pan_cve_2026_0300_exploit.yml

→ Read the full weekly roundup: Security Roundup — Week of May 14, 2026