Palo Alto PAN-OS captive portal RCE under attack

A buffer overflow in PAN-OS Authentication Portal allows unauthenticated remote code execution with root privileges; limited exploitation observed against internet-exposed portals.

A buffer overflow vulnerability (CVE-2026-0300) in the PAN-OS User-ID Authentication Portal service enables unauthenticated attackers to achieve remote code execution with root privileges on Palo Alto Networks PA-Series and VM-Series firewalls by sending specially crafted packets. The vulnerability affects multiple PAN-OS versions spanning 10.2 through 12.1 branches.

Limited exploitation has been observed in the wild targeting Authentication Portals exposed to untrusted networks or the public internet. Organizations following security best practices by restricting portal access to trusted internal networks face significantly reduced risk. No patch is available at the time of this advisory, with Palo Alto Networks expecting to release fixes on May 13, 2026.

Vendor-recommended workarounds include restricting Authentication Portal access to trusted zones only and disabling the portal entirely if not required. The vulnerability represents a critical threat to organizations with internet-facing captive portals, as successful exploitation grants complete system compromise with root-level access to affected firewall appliances.

title: PAN-OS Authentication Portal Accessed From Untrusted Zone
id: 33d23da6-b5ac-531e-8cbd-cdb2df0fd213
status: experimental
description: 'Identifies traffic reaching the PAN-OS Authentication (Captive) Portal
  service from an untrusted or internet-facing zone. CVE-2026-0300 is a buffer overflow
  in this service enabling unauthenticated remote code execution with root privileges.
  Vendor guidance is that the portal should never be reachable from untrusted networks;
  any such connection should be treated as a potential exploitation attempt until
  patches are available.

  '
references:
- https://security.paloaltonetworks.com/
author: Vorant
tags:
- attack.t1190
logsource:
  category: firewall
  product: paloalto
detection:
  selection:
    dst_zone: untrust
    app|contains:
    - captive-portal
    - panos-userid
    - authentication-portal
  filter_trusted_source:
    src_zone: trust
  condition: selection and not filter_trusted_source
falsepositives:
- Intentional internet exposure of the portal for remote user authentication where
  the organization accepts the risk
- Misconfigured zone naming where partner/VPN zones are labelled untrust but are otherwise
  controlled
level: high

title: PAN-OS Authentication Portal Service Unexpected Crash or Restart
id: d31fbdc3-0a44-5bb1-aff0-a33e1475b7d5
status: experimental
description: 'Detects PAN-OS system log messages reporting that the User-ID Authentication
  Portal (captive portal) daemon crashed, generated a core dump, or restarted unexpectedly.
  Such events can indicate exploitation of a buffer overflow vulnerability (CVE-2026-0300)
  causing memory corruption during unauthenticated remote code execution attempts,
  rather than routine maintenance restarts.

  '
references:
- https://security.paloaltonetworks.com/
author: Vorant
tags:
- attack.t1190
logsource:
  category: system
  product: paloalto
detection:
  selection:
    message|contains:
    - authd
    - authentication portal
    - captive portal
  crash_indicators:
    message|contains:
    - core dump
    - unexpectedly
    - crashed
    - restarted
    - segmentation fault
  condition: selection and crash_indicators
falsepositives:
- Planned service restarts during PAN-OS upgrades or configuration commits
- Administrator-initiated restart of the authentication portal service for maintenance
level: medium

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-pan-os-could-allow-for-remote-code-execution_2026-043