Exploited PAN-OS Captive Portal Flaw Gives Attackers Root on Exposed Firewalls

Palo Alto Networks disclosed CVE-2026-0300, a critical CWE-787 buffer overflow in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows unauthenticated remote code execution as root on affected PA-Series and VM-Series firewalls. The flaw carries a CVSS v4 score of 9.3 when the portal is exposed to untrusted networks or the public internet, and Palo Alto confirmed limited in-the-wild exploitation against exposed portals. Affected versions span PAN-OS 10.2, 11.1, 11.2, and 12.1, while Prisma Access, Cloud NGFW, and Panorama are not affected. With patches not immediately available at disclosure, Palo Alto said fixed releases would begin rolling out between May 13 and May 28 and urged customers to restrict portal access to trusted internal zones or disable the feature entirely; the company also released a Threat Prevention Signature for PAN-OS 11.1 and later.

U.S. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate by the mandated deadline, while other national and regional cyber authorities issued parallel alerts. Palo Alto Unit 42 and multiple reports linked the activity to a likely state-sponsored cluster tracked as CL-STA-1132, which reportedly probed targets for weeks, injected shellcode into an nginx worker process, deleted crash artifacts and logs, enumerated Active Directory through firewall-linked service accounts, and used EarthWorm and ReverseSocks5 tunnels for command and control and lateral movement. Researchers warned that thousands of internet-exposed PAN-OS instances remain reachable, making perimeter firewalls with exposed Captive Portal services high-priority compromise candidates.