Palo Alto Networks Discloses CVE-2026-0300, a 9.3 PAN-OS Captive Portal RCE Exploited Since April 9 With Patches Starting May 13
Palo Alto Networks disclosed CVE-2026-0300, a critical buffer overflow in PAN-OS that grants unauthenticated root code execution and has been exploited in the wild since April 9. CISA added it to KEV on May 6 with a May 9 federal deadline; first fixes ship May 13.
Overview
Palo Alto Networks has disclosed a critical buffer overflow in PAN-OS that grants unauthenticated attackers root-level code execution on internet-exposed firewalls, and the company says limited exploitation has been observed in the wild against publicly reachable instances. The flaw, tracked as CVE-2026-0300, affects the User-ID Authentication Portal — commonly known as the Captive Portal — on PA-Series and VM-Series firewalls, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on May 6 with a federal patch deadline of May 9, according to BleepingComputer.
What We Know
The vulnerability is a buffer overflow (CWE-787) in the User-ID Authentication Portal service, and Rapid7 assigns it a CVSSv4 score of 9.3 when the portal is reachable from the internet or untrusted networks. The Hacker News notes that the score drops to 8.7 if access is restricted to trusted internal IP addresses. Successful exploitation gives the attacker arbitrary code execution with root privileges and requires no authentication or user interaction.
Palo Alto Networks confirmed active abuse in a public statement, saying “limited exploitation has been observed targeting Palo Alto Networks User-ID™ Authentication Portals that are exposed to untrusted IP addresses and/or the public internet,” as quoted by BleepingComputer. According to a separate BleepingComputer report, unsuccessful exploitation attempts against PAN-OS devices began on April 9, 2026, and successful remote code execution was first observed roughly a week later — meaning the bug had been under attack for nearly a month before public disclosure.
BleepingComputer reports that Palo Alto Networks’ Unit 42 threat intelligence team is tracking the activity as CL-STA-1132, which it describes as a cluster of likely state-sponsored threat activity. Post-compromise, the operators deployed the Earthworm and ReverseSocks5 tunneling utilities — tools previously associated with Chinese-speaking threat groups including Volt Typhoon and APT41 — and immediately conducted log cleanup, removing crash kernel messages, nginx entries, and core dump files to obscure their trail. Help Net Security added in a May 7 update that the activity bears the markings of state-sponsored threat actors.
The affected products are PA-Series and VM-Series firewalls running vulnerable PAN-OS releases. Palo Alto Networks has stated that “this issue does not impact Cloud NGFW or Panorama appliances,” as cited by BleepingComputer, and Help Net Security reports that Prisma Access is also unaffected.
The attack surface is large. Rapid7 cites Shodan data showing approximately 225,000 internet-facing PAN-OS instances, and BleepingComputer reports that Shadowserver tracks more than 5,400 exposed PAN-OS VM-Series firewalls online, with 2,466 in Asia and 1,998 in North America.
Patch and Mitigation Timeline
Fixes will roll out in two waves. According to Help Net Security, the first set of patches is expected on May 13, 2026, with a second round estimated for May 28, 2026; SecurityWeek reports the same staggered schedule. Until updates are available, Palo Alto Networks recommends that customers restrict access to the User-ID Authentication Portal to trusted internal zones or disable the feature outright. The company says “customers following standard security best practices, such as restricting sensitive portals to trusted internal networks are at a greatly reduced risk,” according to BleepingComputer.
CISA’s KEV listing imposes a tighter clock on federal agencies than the vendor’s patch schedule. BleepingComputer reports that the agency ordered Federal Civilian Executive Branch organizations to secure vulnerable firewalls by May 9 — four days before the first vendor patches arrive — meaning agencies that cannot wait must rely on the network-level mitigations Palo Alto Networks has published.
What We Don’t Know
The full scope and victimology of CL-STA-1132’s campaign has not been published. Unit 42 has not named confirmed victim organizations, and neither Palo Alto Networks nor the published reports have disclosed how the operators initially discovered the bug or whether they were the only group to find it. The exact volume of successful compromises is also unclear; Palo Alto Networks has characterized the abuse only as “limited.” Whether other PAN-OS-adjacent products will require additional advisories — beyond the explicit Cloud NGFW, Panorama, and Prisma Access carve-outs — has not been addressed publicly.