Critical PAN-OS Captive Portal Flaw Let Attackers Gain Root on Firewalls

Palo Alto Networks disclosed CVE-2026-0300, a critical CWE-787 out-of-bounds write in the PAN-OS User-ID Authentication Portal, also known as the Captive Portal, that allows an unauthenticated attacker to achieve remote code execution as root on affected PA-Series and VM-Series firewalls. The flaw was reported as actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, with exploitation observed against portals reachable from untrusted networks or the public internet. Palo Alto said Prisma Access, Cloud NGFW, and Panorama are not affected, while vulnerable PAN-OS branches included 10.2, 11.1, 11.2, and 12.1 below fixed releases.

Reporting on observed intrusions said attackers used the firewall access for shellcode injection into nginx worker processes, credential extraction, Active Directory enumeration, outbound tunneling with tools such as EarthWorm and ReverseSocks5, internal pivoting, and anti-forensic log cleanup. Palo Alto began releasing patches in staged waves and urged defenders to disable the Captive Portal if unused or restrict it to trusted IPs and zones, enable available threat-prevention signatures, and treat previously exposed devices as potentially fully compromised by auditing configurations, checking admin accounts and SSH keys, rotating credentials, and monitoring for persistence or suspicious outbound connections.