CL-STA-1132 Exploitation User-Agent (CVE-2026-0300)

Tim Peck@timpeck

•updated May 7, 2026•5•0•557

Detects the malformed User-Agent string used by CL-STA-1132 during exploitation of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and has no known legitimate origin.