VORANT. Threat Intelligence Sign in Get the full feed

PAN-OS User-ID Portal Flaw Under Attack

high vulnerability

A buffer overflow vulnerability in Palo Alto Networks PAN-OS User-ID Authentication Portal is being actively exploited to achieve remote code execution.

IPA has issued an alert regarding CVE-2026-0300, a buffer overflow vulnerability affecting the User-ID Authentication Portal component of Palo Alto Networks' PAN-OS. The vendor has confirmed that the vulnerability is already being exploited in the wild by remote attackers, who could leverage it to execute arbitrary code on affected devices. Prisma Access, Cloud NGFW, and Panorama appliances are reportedly not affected by this issue.

Organizations using PAN-OS are urged to check whether the User-ID Authentication Portal feature is enabled and review access restrictions, applying vendor-recommended mitigations if they are exposed. IPA also recommends closely monitoring for vendor patches and applying updates promptly once available, given the active exploitation and potential for expanding attacks.

Mentioned in this report

Vulnerabilities CVE-2026-0300KEV

Related reporting

Detection guidance

PAN-OS User-ID Portal Buffer Overflow Exploitation Attempt

ATT&CK T1190

Detects HTTP requests to PAN-OS User-ID Authentication Portal with abnormally large payloads or null bytes characteristic of buffer overflow exploit attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PAN-OS User-ID Portal Buffer Overflow Exploitation Attempt
description: Detects HTTP POST/GET requests to the User-ID Authentication Portal endpoint
  with oversized payloads or null-byte patterns indicative of buffer overflow exploitation
  (CVE-2026-0300).
tags:
- attack.t1190
logsource:
  category: proxy
  product: paloaltonetworks
detection:
  selection:
    http_method:
    - POST
    - GET
    uri|contains:
    - /userid
    - /user-id
    - /auth
    payload_size|gt: 8192
  selection_nullbyte:
    http_request_body|contains: \x00
  filter_legitimate:
    http_method: POST
    uri|contains: /form
    payload_size|lt: 2048
  condition: (selection or selection_nullbyte) and not filter_legitimate
falsepositives:
- Legitimate file upload operations to the User-ID portal with large payloads
- Network monitoring tools injecting test data
level: high
id: 84eb0f14-f6eb-5c44-8c32-5fd837a41715
status: experimental
author: Vorant

Abnormal Process Execution Following PAN-OS Authentication Portal Request

ATT&CK T1190

Detects arbitrary code execution (process spawning) on PAN-OS appliance following HTTP requests to the User-ID Authentication Portal, indicating successful buffer overflow exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Abnormal Process Execution Following PAN-OS Authentication Portal Request
description: Detects arbitrary process execution on PAN-OS devices immediately following
  HTTP requests to the User-ID Authentication Portal endpoint, indicating post-exploitation
  code execution from CVE-2026-0300.
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: paloaltonetworks
detection:
  http_request:
    previous_http_uri|contains:
    - /userid
    - /user-id
    - /auth
    previous_http_method:
    - POST
    - GET
  process_spawn:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \bash
    - \sh
    ParentImage|contains:
    - lighttpd
    - apache
    - nginx
  condition: http_request and process_spawn
falsepositives:
- Legitimate User-ID portal configuration scripts triggering system processes
- Automated backup or diagnostic routines coinciding with portal access
level: critical
id: da3d845e-f1af-58d7-a862-c040890f5878
status: experimental
author: Vorant

PAN-OS User-ID Portal Memory Corruption Indicators

ATT&CK T1190

Detects suspicious HTTP request patterns with repeated characters, encoded payloads, or stack-smashing signatures targeting the User-ID Authentication Portal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PAN-OS User-ID Portal Memory Corruption Indicators
description: Detects HTTP requests to the User-ID Authentication Portal endpoint containing
  patterns consistent with buffer overflow payload delivery, such as repeated byte
  sequences, ROP gadget chains, or encoded shellcode.
tags:
- attack.t1190
logsource:
  category: proxy
  product: paloaltonetworks
detection:
  selection_portal:
    uri|contains:
    - /userid
    - /user-id
    - /auth
  selection_payload_pattern:
    http_request_body|re:
    - ([A-Fa-f0-9]{2}){128,}
    - (\\x[0-9A-Fa-f]{2}){64,}
    - ([^\x20-\x7E]{10,})
  selection_rop:
    http_request_body|contains:
    - rop
    - gadget
    - \x90\x90\x90
  condition: selection_portal and (selection_payload_pattern or selection_rop)
falsepositives:
- Legitimate encoded authentication credentials in POST data
- Binary file uploads to the portal
level: medium
id: 78ab2109-5ae3-5507-a824-66d1c7c66dec
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20260508.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free