Exploitation of PAN-OS Captive Portal CVE-2026-0300

On May 6, 2026, a critical buffer overflow vulnerability (CVE-2026-0300) was disclosed in the User-ID Authentication Portal (Captive Portal) of Palo Alto Networks PAN-OS. This zero-day allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets. The vulnerability is actively being exploited in the wild by a suspected state-sponsored threat cluster designated as CL-STA-1132.

Technical analysis reveals that attackers are achieving initial access by injecting shellcode into nginx worker processes. Post-exploitation, the threat actor deploys open-source tunneling tools like EarthWorm and ReverseSocks5 to maintain persistence and facilitate lateral movement. They have also been observed conducting Active Directory enumeration using stolen firewall service account credentials and performing targeted SAML floods to force device failover and compromise secondary appliances.

This activity is highly critical due to the unauthenticated nature of the exploit and the high-privilege access it provides on edge security infrastructure. Organizations using PA-Series and VM-Series firewalls must immediately restrict portal access to trusted zones or disable the service entirely until patches are released starting May 13, 2026.