10 Critical Facts About the PAN-OS Captive Portal Zero-Day Exploit (CVE-2026-0300)

Unit 42 researchers recently uncovered a serious zero-day vulnerability in Palo Alto Networks' PAN-OS software. Tracked as CVE-2026-0300, this buffer overflow flaw in the User-ID Authentication Portal allows unauthenticated attackers to execute arbitrary code remotely. If exploited, it could give adversaries full control over affected firewalls. This listicle distills everything you need to know—from technical details to actionable defenses.

1. What Is CVE-2026-0300?

CVE-2026-0300 is a buffer overflow vulnerability residing in the captive portal component of the PAN-OS User-ID Authentication Portal. When a specially crafted request is sent to the portal, the software fails to properly validate input length, leading to memory corruption. An unauthenticated attacker—no credentials required—can trigger this flaw to inject malicious code. The result? Remote code execution (RCE) with the privileges of the affected service, typically root-level access on the firewall appliance.

2. Severity and CVSS Score

While the official CVSS score is still pending, early analysis places this vulnerability in the critical range (9.0–10.0). The attack vector is network-based, complexity is low, no authentication is required, and the impact on confidentiality, integrity, and availability is high. Organizations should treat this as an emergency patching priority.

3. Affected PAN-OS Versions

The vulnerability impacts PAN-OS 10.x, 11.0, and 11.1 series that have the User-ID Authentication Portal enabled. Specific affected builds include versions prior to the security hotfix released by Palo Alto Networks. Confirm your firmware version immediately—check the release notes for the exact patched versions, such as 10.2.11-h1, 11.0.6-h2, and 11.1.4-h1. (See mitigation details below.)

4. How the Exploit Works

Attackers send a malformed HTTP request to the captive portal login interface. The User-ID Authentication Portal parses the request without bounds checking, overwriting adjacent memory regions. This classic stack-based buffer overflow gives the attacker control over the program counter. Shellcode can then be inserted to establish a reverse shell, install backdoors, or pivot to internal networks. No prior authentication or user interaction is needed.

5. Real-World Exploitation Observed

Unit 42's threat intelligence teams have detected active exploitation in the wild before a patch was available—making it a true zero-day. Multiple threat actors appear to be probing vulnerable systems, particularly in government, finance, and healthcare sectors. The exploit code is straightforward, lowering the barrier for less skilled attackers.

6. Impact on Network Security

Successful exploitation grants attackers full administrative access to the firewall. This can lead to:

• Disabling security policies
• Reading or modifying VPN tunnels
• Exfiltrating logs and credentials
• Using the firewall as a launchpad for lateral movement

The firewall, typically a network's first line of defense, becomes a threat.

7. Immediate Mitigation Steps

If you cannot patch immediately, disable the User-ID Authentication Portal if not needed for operations. Alternatively, restrict access to the captive portal interface using IP allowlists or put it behind a VPN. Palo Alto Networks has released hotfixes—apply them as soon as possible via the Customer Support Portal.

8. Permanent Fix and Patching

Palo Alto Networks has released security updates for all affected branches. Download and install:

• PAN-OS 10.2.11-h1 (or later)
• PAN-OS 11.0.6-h2 (or later)
• PAN-OS 11.1.4-h1 (or later)

After patching, verify the captive portal service is restarted. Monitor logs for any prior exploitation signs.

9. Detection Indicators (IOCs)

Look for unusual HTTP POST requests to the captive portal endpoint (/auth/authentication.cgi or similar). Signs include:

• Requests with extremely long parameter values
• Non-standard User-Agent strings
• Connection attempts from suspicious IPs known for scanning
• Unexpected high CPU or memory usage on the firewall

Unit 42 has shared specific IOCs in their full threat brief.

10. Long-Term Recommendations

Beyond patching, adopt a zero-trust architecture for your network perimeter. Ensure that the User-ID Authentication Portal is not exposed to the internet unless absolutely necessary. Regularly audit firewall configurations and subscribe to security advisories from Palo Alto Networks. Consider deploying a web application firewall (WAF) in front of captive portals for an extra layer of defense.

Conclusion

CVE-2026-0300 is a stark reminder that even trusted security appliances can harbor critical flaws. By understanding the vulnerability, prioritizing patching, and monitoring for signs of compromise, organizations can mitigate risk effectively. Stay informed, stay updated.