Siemens RUGGEDCOM APE1808 devices affected by critical Palo Alto PAN-OS buffer overflow…

19 May 2026 critical vulnerability manufacturing

Siemens RUGGEDCOM APE1808 devices affected by critical Palo Alto PAN-OS buffer overflow allowing unauthenticated remote code execution with root privileges.

A critical buffer overflow vulnerability (CVE-2026-0300) has been identified in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS software running on Siemens RUGGEDCOM APE1808 devices. An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to execute arbitrary code with root privileges on affected PA-Series and VM-Series firewalls. All versions of RUGGEDCOM APE1808 devices are vulnerable.

Siemens is preparing fix versions and has recommended several mitigations while patches are being developed. Organizations should disable Response Pages in Interface Management Profiles on untrusted interfaces, disable the User-ID Authentication Portal if not required, and restrict access to trusted internal IP addresses only. The vulnerability affects critical manufacturing sectors worldwide.

CISA recommends minimizing network exposure for affected control system devices, ensuring they are not accessible from the internet, and isolating them behind firewalls. Organizations should consult Palo Alto Networks' upstream security notifications and contact Siemens customer support for patch information.

Mentioned in this report

Vulnerabilities CVE-2026-0300KEV

Detection guidance

Inbound External Access to PAN-OS Captive Portal / User-ID Authentication Service

ATT&CK T1190

Detects inbound connections to the PAN-OS User-ID Authentication (Captive) Portal service from untrusted/external network zones, which vendor guidance recommends restricting due to a critical unauthenticated buffer overflow (CVE-2026-0300) allowing root code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inbound External Access to PAN-OS Captive Portal Service
id: e5fae4f4-002c-53a2-8b0f-e0b39ce7e283
status: experimental
description: 'Detects network connections reaching the PAN-OS Captive Portal / User-ID
  Authentication Portal

  service from source addresses outside the trusted internal address space. CVE-2026-0300
  allows

  unauthenticated remote code execution as root via crafted packets to this service
  on Siemens

  RUGGEDCOM APE1808 devices running PAN-OS. Vendor mitigation is to restrict this
  service to

  trusted internal IPs only, so any external/untrusted access to it is notable and
  should be

  reviewed, especially repeated or malformed connection attempts.

  '
logsource:
  category: network_connection
  product: windows
definition: Applies equally to firewall/network device connection logs (e.g. PAN-OS
  traffic logs) if ingested; category network_connection used as generic placeholder
  for perimeter device telemetry.
detection:
  selection:
    DestinationPort:
    - 443
    - 4443
    dst_zone|contains: untrust
  filter_trusted:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_trusted
fields:
- SourceIp
- DestinationIp
- DestinationPort
- dst_zone
falsepositives:
- Legitimate remote administrators or partner networks whose IP ranges have not yet
  been added to the trusted allow-list
- Misconfigured internal network segmentation causing internal hosts to appear as
  untrusted zone traffic
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant

Anomalously Large Requests to PAN-OS Captive Portal Endpoint (Possible Buffer Overflow Attempt)

ATT&CK T1190

Flags unusually large HTTP requests or oversized parameters sent to the PAN-OS Captive Portal / User-ID authentication endpoint, consistent with buffer overflow exploitation attempts against CVE-2026-0300. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Oversized Request to PAN-OS Captive Portal Authentication Endpoint
id: bde617b1-82d4-5b39-93b3-5464103dcf60
status: experimental
description: 'Detects abnormally large HTTP requests or request bodies directed at
  the PAN-OS Captive Portal /

  User-ID Authentication Portal endpoint. CVE-2026-0300 is a buffer overflow in this
  service reached

  by sending specially crafted (oversized/malformed) packets, allowing unauthenticated
  root code

  execution on Siemens RUGGEDCOM APE1808 devices. Legitimate captive portal authentication
  requests

  are small; requests far exceeding typical size for this endpoint warrant investigation.

  '
logsource:
  category: proxy
  product: null
detection:
  selection:
    cs-uri-stem|contains:
    - /global-protect/portal
    - /captive-portal
    - /php/uid.php
  large_request:
    cs-bytes|gt: 8192
  condition: selection and large_request
fields:
- c-ip
- cs-uri-stem
- cs-bytes
- sc-status
falsepositives:
- Bulk certificate or multi-factor authentication payloads legitimately exceeding
  normal request size
- Vulnerability scanners or health-check tools probing the portal with large synthetic
  payloads
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-02

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free