State-Sponsored Actors Exploit Critical PAN-OS Zero-Day (CVE-2026-0300) for Remote Code Execution
PAN-OS Zero-Day CVE-2026-0300 Actively Exploited for Unauthenticated RCE
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
CVE Identifiers
Full Report(when first published)
Executive Summary
On May 6, 2026, Palo Alto Networks disclosed a critical zero-day vulnerability, CVE-2026-0300, affecting its PAN-OS software. The vulnerability is a buffer overflow in the User-ID™ Authentication Portal (Captive Portal) service that allows an unauthenticated attacker to achieve remote code execution (RCE) with root privileges on affected firewalls.
Unit 42 has observed active, albeit limited, exploitation of this vulnerability in the wild by a likely state-sponsored threat actor tracked as CL-STA-1132. The actor's campaign demonstrates a high level of sophistication, leveraging the exploit for initial access, followed by the deployment of open-source tools for persistence and lateral movement, and concluding with thorough evidence destruction. Given the criticality of the vulnerability and its position on the network edge, organizations using affected PAN-OS versions are urged to apply patches or implement mitigations immediately.
Vulnerability Details
CVE-2026-0300 is a buffer overflow vulnerability residing in the Captive Portal service of PAN-OS. An unauthenticated attacker on the network can send specially crafted packets to a vulnerable firewall's Captive Portal interface. Successful exploitation overflows a buffer in an nginx worker process, allowing the attacker to inject and execute arbitrary shellcode.
Critically, the code execution occurs with root privileges, granting the attacker complete control over the compromised firewall appliance. The attack does not require any user interaction or prior authentication, making it a wormable threat, although no such activity has been observed yet. The vulnerability affects the firewall's control plane and can be exploited by any attacker with network access to the exposed Captive Portal service.
Affected Systems
The vulnerability impacts the following Palo Alto Networks products when the User-ID Authentication Portal (Captive Portal) is enabled:
- PA-Series Firewalls (hardware)
- VM-Series Firewalls (virtualized)
According to Palo Alto Networks, the following products are NOT affected:
- Prisma Access
- Cloud NGFW
- Panorama appliances
The primary risk factor is the exposure of the User-ID Authentication Portal to the internet or other untrusted networks. Systems configured according to best practices, where the portal is only accessible from trusted internal networks, have a significantly reduced risk profile.
Exploitation Status
Unit 42 reports that a threat actor cluster, CL-STA-1132, began attempting to exploit this vulnerability as a zero-day starting on April 9, 2026. Successful RCE was achieved approximately a week later. The activity is described as limited and targeted, consistent with cyber espionage operations conducted by a nation-state actor.
The attack timeline indicates a methodical approach:
- Initial Access: The actor exploited CVE-2026-0300 to gain root-level RCE.
- Defense Evasion: Immediately after compromise, the actor cleared crash logs, deleted
nginxcrash records, and removed core dump files to hide their tracks. - Staging & Persistence: Days later, the actor deployed tunneling tools, including EarthWorm and ReverseSocks5, to establish persistent C2 channels.
- Discovery & Lateral Movement: The actor used credentials obtained from the firewall to perform Active Directory enumeration and later conducted a SAML flood to force a failover and compromise a second device.
Impact Assessment
The impact of exploiting CVE-2026-0300 is severe. A compromised edge firewall represents a total failure of the network perimeter's integrity. As a root-level compromise, the attacker gains:
- Complete Control: The ability to monitor, modify, or drop all traffic passing through the firewall.
- Credential Access: Potential access to sensitive credentials stored on the device, such as service account passwords for AD integration, RADIUS secrets, or VPN keys.
- Pivoting Point: A trusted, persistent foothold within the network from which to launch further attacks, move laterally, and exfiltrate data.
- Stealth: The ability to disable logging or manipulate logs on the firewall itself, making detection of subsequent activities extremely difficult.
Given that the attackers are using this access to enumerate Active Directory, the ultimate goal is likely widespread internal compromise and data exfiltration, aligning with the objectives of state-sponsored espionage campaigns.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were provided in the source article.
Cyber Observables — Hunting Hints
The following patterns could indicate related activity and may be useful for threat hunting:
nginx worker/var/log/, /var/tmp/).Detection & Response
Security teams should prioritize both detection and response actions:
- Apply Threat Prevention Signatures: Customers with an Advanced Threat Prevention subscription should enable Threat ID 510019 (requires content version 9097-10022 and PAN-OS 11.1 or later) to block exploitation attempts.
- Analyze Firewall Logs: Review system, traffic, and User-ID logs for signs of compromise. Look for unexplained reboots, log gaps, or connections from the firewall to unusual external IP addresses. Use the Network Traffic Analysis (D3-NTA) technique to baseline normal traffic and identify anomalies.
- Monitor Internal Network: Scrutinize logs from Domain Controllers for unusual LDAP or DNS queries originating from the firewall's service account. This could indicate successful compromise and lateral movement attempts. This aligns with D3FEND's Domain Account Monitoring (D3-DAM).
- Utilize Xpanse: Cortex Xpanse can be used to identify internet-exposed instances of the User-ID Authentication Portal that are potentially vulnerable.
If a compromise is suspected, organizations should consider engaging an incident response team to determine the extent of the breach and perform full remediation.
Mitigation
Palo Alto Networks strongly recommends applying the security updates immediately. If patching is not immediately possible, the following workarounds can mitigate the risk:
- Restrict Access (Primary Mitigation): The most effective mitigation is to adhere to the best practice of restricting access to the Captive Portal. Configure security policies to ensure the User-ID Authentication Portal interface is only accessible from trusted, internal network zones. It should not be exposed to the internet. This is an application of MITRE ATT&CK Mitigation
M1035 - Limit Access to Resource Over Network. - Temporary Disablement: If not in use, disable the User-ID Authentication Portal entirely.
Long-term strategic mitigations include:
- Network Segmentation: Implement robust network segmentation (
M1030 - Network Segmentation) to limit the blast radius of a compromised edge device, preventing an attacker from easily moving laterally into critical internal segments. - Egress Filtering: Enforce strict egress traffic filtering (
M1037 - Filter Network Traffic) to block outbound connections from the firewall and other critical infrastructure to unauthorized destinations, which could disrupt C2 channels established by tools like EarthWorm.
Timeline of Events
Article Updates
May 10, 2026
CISA issues emergency directive for PAN-OS zero-day (CVE-2026-0300); patches not yet available, expected May 13.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Applying the patches provided by Palo Alto Networks is the most effective way to remediate the vulnerability itself.
Mapped D3FEND Techniques:
Restricting network access to the PAN-OS Captive Portal interface to only trusted internal IP addresses greatly reduces the attack surface, preventing unauthenticated external attackers from reaching the vulnerable service.
Mapped D3FEND Techniques:
Filter Network Traffic
Implementing strict egress filtering rules can block outbound connections from the firewall on non-standard ports, potentially disrupting C2 channels established by tools like EarthWorm and ReverseSocks5.
Mapped D3FEND Techniques:
Network Intrusion Prevention
Deploying and enabling the specific Threat ID (510019) on Palo Alto Networks firewalls with an Advanced Threat Prevention subscription can detect and block exploit attempts.
D3FEND Defensive Countermeasures
The primary and most crucial countermeasure is to apply the security patches released by Palo Alto Networks for CVE-2026-0300. Organizations must prioritize the deployment of these updates, starting with internet-facing firewalls where the Captive Portal is enabled. A risk-based approach should be followed: first patch externally-exposed systems, then high-value internal segment gateways, and finally the rest of the fleet. Before deployment, organizations should validate the patch in a non-production environment to ensure no operational impact. After patching, it is essential to verify that the update was successful and the system is no longer vulnerable using vulnerability scanners or by checking the PAN-OS version. This technique directly remediates the root cause of the threat by fixing the buffer overflow flaw, rendering the exploit ineffective.
As a critical compensating control, organizations must implement network isolation for the PAN-OS Captive Portal interface. This involves creating and enforcing strict security policies and access control lists (ACLs) that restrict access to the management and User-ID interfaces. These interfaces should never be exposed to the public internet. Access should be limited to a dedicated, secure management network or a small set of trusted internal IP addresses (jump hosts). This directly mitigates the risk from unauthenticated external attackers, as they would have no network path to the vulnerable service. This technique acts as a powerful barrier, effectively reducing the attack surface to zero from untrusted networks, even on an unpatched device.
To detect potential post-compromise activity, security teams should employ Network Traffic Analysis (NTA). Specifically for this threat, focus on monitoring egress traffic originating from the firewall's own interfaces. Establish a baseline of normal traffic patterns and alert on anomalies. Key indicators to monitor include: new or unusual outbound connections from the firewall's management IP, traffic using the SOCKSv5 protocol (indicative of EarthWorm/ReverseSocks5), connections to known malicious IPs or unusual geolocations, and large, unexplained data transfers. NTA tools can provide the necessary visibility to detect these C2 channels and data exfiltration attempts, even if the attacker has disabled logging on the firewall itself. This provides a crucial detection layer that is independent of the compromised device.
Timeline of Events
Threat actor CL-STA-1132 begins unsuccessful exploitation attempts against a PAN-OS device.
Attackers successfully achieve RCE against the device, inject shellcode, and immediately begin clearing logs.
Attackers deploy tools, including EarthWorm and ReverseSocks5, with root privileges.
Active Directory enumeration is conducted using the firewall's service account credentials.
A SAML flood is initiated against the first device, causing a failover to a second device, which is then also compromised.
Palo Alto Networks releases the security advisory for CVE-2026-0300.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.