CVE-2026-0300Active Exploitation(paloaltonetworks / pa-1410)

🚨 Critical Palo Alto Firewalls Vulnerability Exploited in the Wild to Gain Root Access Source: https://cybersecuritynews.com/palo-alto-firewalls-vulnerability-exploited/ Palo Alto Networks has disclosed a critical buffer overflow vulnerability in PAN-OS software, tracked as CVE-2026-0300, that is already being actively exploited in the wild. The flaw carries a CVSS 4.0 score of 9.3 (CRITICAL) and allows unauthenticated attackers to execute arbitrary code with full root privileges on affected PA-Series and VM-Series firewalls, with no credentials, no user interaction, and no special conditions required. The vulnerability resides in the User-ID™ Authentication Portal (also known as Captive Portal) service of PAN-OS. The vulnerability impacts multiple PAN-OS versions across PA-Series and VM-Series firewalls. #cybersecuritynews #vulnerability

‼️🚨 CRITICAL: Palo Alto Networks has disclosed CVE-2026-0300, a buffer overflow in PAN-OS that is already being exploited in the wild. CVSS 4.0 score: 9.3. Unauthenticated attackers can hit the User-ID Authentication Portal (the Captive Portal service) with crafted packets and pop a root shell on the firewall. The flaw is an out-of-bounds write (CWE-787) in PA-Series and VM-Series firewalls. Prisma Access, Cloud NGFW, and Panorama are not affected. The vulnerability only triggers when the User-ID Authentication Portal is enabled and reachable from untrusted networks. Affected branches: - PAN-OS 10.2 below 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 - PAN-OS 11.1 below 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 - PAN-OS 11.2 below 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12 - PAN-OS 12.1 below 12.1.4-h5, 12.1.7 Patches roll out between May 13 and May 28, 2026. A Threat Prevention signature for PAN-OS 11.1 and above shipped on May 5. Mitigations before patches roll out: - Restrict Authentication Portal access to trusted internal IPs only - Disable the User-ID Authentication Portal entirely if not needed Compromising a perimeter firewall as root opens the door to lateral movement, traffic interception, credential harvesting, and full network takeover. Audit Device > User Identification > Authentication Portal Settings and treat any internet-exposed portal as an emergency.

Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows. Opendir: 142.171.160[.]137:8888 VULN-MONITOR: 142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔 CyberStrikeAI Server: 100.81.245[.29:8080 Chain: FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations. Targeted CVEs: CVE-2026-0300 (Palo Alto PAN-OS) CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN) CVE-2026-33017 (Langflow) CVE-2026-21858 (n8n) CVE-2026-3055 (Citrix ADC/NetScaler) CVE-2026-34486 (Apache Tomcat) CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot) @malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara

‼️ Nuclei template for fingerprinting the PAN-OS CVE-2026-0300 zero-day: https://github.com/projectdiscovery/nuclei-templates/blob/25b1082881e20b9eb1a5cf69dca381e736f351da/http/exposed-panels/panos-management-panel.yaml Credit: @rxerium https://t.co/Qxjm1RjGfl

🚨 Palo Alto has disclosed a zero day: CVE-2026-0300 (CVSS 9.3) - a buffer overflow vulnerability in the Captive Portal service of PAN-OS. Nuclei template for fingerprinting PAN-OS: https://github.com/projectdiscovery/nuclei-templates/blob/25b1082881e20b9eb1a5cf69dca381e736f351da/http/exposed-panels/panos-management-panel.yaml This issue is applicable only to PA-Series and VM-Series firewalls that are configured to use User-ID™ Authentication Portal - Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability. No patches are available yet, only workarounds. Full details and mitigations are in the official advisory. https://security.paloaltonetworks.com/CVE-2026-0300

‼️CVE-2026-0300: PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID Authentication Portal CVSS 9.3 PoC: https://github.com/p3Nt3st3r-sTAr/CVE-2026-0300-POC FOFA Query: app="Palo-Alto-pan-os" FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJQYWxvLUFsdG8tcGFuLW9zIg== Results: 32,070 Blog Post: https://www.rapid7.com/blog/post/etr-critical-buffer-overflow-in-palo-alto-networks-pan-os-user-id-authentication-portal-cve-2026-0300/

Detection script for CVE-2026-0300 - honing in on captive portals: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-0300.yaml Also allows for verification of device models given this issue is only applicable to PA-Series and VM-Series firewalls. https://t.co/t4wFY5wmpx

🚨 PAN-OS firewalls hit by active exploitation of CVE-2026-0300, enabling unauthenticated RCE with root access. The unpatched flaw targets publicly exposed User-ID portals, affecting multiple versions. Fixes expected May 13, 2026. Read the full story: https://thehackernews.com/2026/05/palo-alto-pan-os-flaw-under-active.html

⚠️ ثغرة خطره في (Palo Alto PAN-OS) برقم (CVE-2026-0300) بتقييم 9.3 . الثغرة حرجة جداً و CISA أضافتها فوراً لقائمة الثغرات المستغلة فعلياً (KEV). اذا تحب تعرف تفاصيل اكثر اقراء التغريدات التاليه: 👇 https://t.co/WkCeXFf5dM

🚨 PAN-OS flaw "CVE-2026-0300" exploited for unauthenticated RCE with root access. Attacks began April 9, achieved within a week, followed by espionage and lateral movement by April 29. Full details and timeline: https://thehackernews.com/2026/05/pan-os-rce-exploit-under-active-use.html

GitHub - p3Nt3st3r-sTAr/CVE-2026-0300-POC · GitHub https://github.com/p3Nt3st3r-sTAr/CVE-2026-0300-POC

🛡️ We added Palo Alto Networks PAN-OS out-of-bounds write vulnerability CVE-2026-0300 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/dxItrieU6c

🚨 Overnight watchTowr rapidly reacted to CVE-2026-0300, an unauthenticated buffer overflow in Palo Alto PAN-OS User-ID Auth Portal. RCE as root on PA-/VM-Series. No patch. Palo Alto: limited ITW exploitation. Existing watchTowr clients aware of exposure. Reach out for support. https://t.co/zkscfaL5HL

Palo Alto NetworksのファイアウォールOSであるPAN-OSに、深刻な脆弱性（CVE-2026-0300）が発見され、すでに実際の攻撃で悪用されていることが報告された。この問題はUser-ID認証ポータル（Captive Portal）に存在するバッファオーバーフローで、特別に細工された通信を送ることで未認証の攻撃者でも侵入可能となる。 攻撃が成功すると、ファイアウォール上で任意のコードがroot権限で実行され、通信の傍受や内部ネットワークへの侵入、セキュリティ機能の無効化など、完全な制御を奪われる危険がある。特にインターネットに公開されたポータルを使用している環境ではリスクが高い。一方で、Prisma AccessやCloud NGFWなど一部のサービスは影響を受けない。 修正パッチは順次提供予定だが、即時対応としてポータルへのアクセス制限、不要な機能の無効化、脅威防御機能の有効化などの緩和策が推奨されている。 https://securityonline.info/palo-alto-networks-cve-2026-0300-active-exploitation-captive-portal-rce/

CVE-2026-0300 is a PAN-OS zero-day in User-ID Authentication Portal/Captive Portal (6080/6081/6082/tcp). Limited exploitation confirmed; unpatched as of May 7, 2026. My research: 2,986 of 62,616 public PAN-OS servers (4.8%) expose these ports. 2nd image: sample attack surface. https://t.co/vw0Cg2auxT

CVE-2026-0300 Restrict interfaces …. You should be doing that where appropriate/possible anyway….. https://t.co/QvPiwhDHfn

No big exploit activity on the recent Palo Alto vuln (CVE-2026-0300), but a decent amount of scanning activity like this "exposure survey" Feels like a lot of these are looking in the wrong direction though, both in terms of ports and paths.. https://t.co/5IDENutlWt

CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID Authentication Portal https://security.paloaltonetworks.com/CVE-2026-0300

( ꒪⌓꒪)…リモートからコマンド実行可能ゼロデイのあるNext Generation Firewall、最高かよｗｗ 愛おし過ぎてかれこれ10年以上使い続けてるけどｗ(PA-2050→PA-5050→PA-1420) 10年経ってもNext Generationなのは気のせいだ！囧rz CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal https://security.paloaltonetworks.com/CVE-2026-0300

Uwaga na aktywnie wykorzystywaną podatność w urządzeniach Palo Alto. CVE-2026-0300 ❌ Wycena krytyczności to prawie max w skali CVSS / ❌ Od strony technicznej to Unauthenticated user initiated Buffer Overflow - czyli z poziomu internetu można uzyskać uprawnienia (prawdopodobnie że jako root) na systemie operacyjnym urządzenia. ❌ Producent parę godzin temu wydał łatkę, dodając że luka jest aktywnie wykorzystywana: "Limited exploitation has been observed targeting Palo Alto Networks User-ID™ Authentication Portals that are exposed to untrusted IP addresses and/or the public internet." ✅ Łatajcie swoje urządzenia, zanim przejmą je boty czy inne łobuzy