Palo Alto Networks PAN-OS CVE-2026-0300 Exploitation Attempt

Ibrahim Saud@tektrix

•updated Jun 23, 2026•2•0•12

This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.