Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution
Summary: Palo Alto Networks issued an advisory on May 6, 2026 for CVE-2026-0300, a buffer overflow in the PAN-OS User-ID Authentication Portal that lets an unauthenticated attacker run arbitrary code with root privileges on PA-Series and VM-Series firewalls via specially crafted packets. Unit 42 tracked the activity as CL-STA-1132, a likely state-sponsored cluster that gained RCE, injected shellcode into an nginx worker process, deployed EarthWorm and ReverseSocks5, enumerated Active Directory with firewall service account credentials, and deleted logs and crash evidence.
What's compelling: The attackers used open-source tooling and intermittent sessions over a multi-week period to stay under automated alerting thresholds, and they cleared crash kernel messages, nginx crash records and core dumps immediately after compromise - so an edge firewall with thin logging may show no sign it was ever touched.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0300
- Related
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability Known Exploited Vulnerabilities · May 06, 2026