Skip to content
skopnix

Actively exploited · CISA KEV · NVD published 2026-05-06

CVE-2026-0300

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID™ Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

Signals

Exploited in the wild
Yesadded 2026-05-06 · due 2026-05-09. An observation, not a forecast.
EPSS · 30-day forecast
32%Chance of exploitation in the next 30 days, 98th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

10 known · links only

GitHub PoCs · by trust, then stars10

  1. p3Nt3st3r-sTAr/CVE-2026-0300-POC ↗Trust ok 100

    ★ 22 · created 2026-05-06

  2. matad0r-maghribi/CVE-2026-0300-PANOS ↗Trust ok 100

    Security Research and Proof-of-Concept (PoC) for CVE-2026-0300 : Unauthenticated Remote Code Execution (RCE) in Palo Alto Networks PAN-OS User-ID Portal.

    ★ 4 · created 2026-05-06

  3. qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC ↗Trust ok 100

    A research-grade Proof-of-Concept (PoC) for CVE-2026-0300, targeting the Buffer Overflow vulnerability in Palo Alto Networks PAN-OS User-ID™ Authentication Portal (CWE-787).

    ★ 3 · created 2026-05-06

  4. ridhinva/panos-captive-portal-rce ↗Trust ok 100

    Scanner: CVE-2026-0300 PAN-OS User-ID Captive Portal Buffer Overflow RCE — Python CLI for detecting actively exploited BOF vulnerability in Palo Alto firewalls (CISA KEV 2026-05-13)

    ★ 2 · created 2026-05-22

  5. 0xBlackash/CVE-2026-0300 ↗Trust ok 100

    CVE-2026-0300

    ★ 1 · created 2026-05-06

  6. mr-r3b00t/CVE-2026-0300 ↗Trust ok 100

    a honeypot for CVE-2026-0300

    ★ 1 · created 2026-05-06

  7. shizuku198411/CVE-2026-0300 ↗Trust ok 100

    PAN-OS CVE-2026-0300 Non-Destructive Exposure Survey Tool

    ★ 1 · created 2026-05-06

  8. lu4m575/CVE-2026-0300 ↗Trust ok 100

    CVE-2026-0300 PAN-OS 12.1, 11.2, 11.1, 10.2

    ★ 0 · created 2026-05-21

  9. sam00/POC-CVE-2026-0300-exploit ↗Trust ok 100

    Palo Alto - CVE-2026-0300 exploit

    ★ 0 · created 2026-08-06

  10. TailwindRG/cve-2026-0300-audit ↗Trust ok 100

    Read-only audit tooling for CVE-2026-0300 (PAN-OS User-ID Authentication Portal exposure)

    ★ 0 · created 2026-05-06

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

On the wire

1 dispatch
  1. RT by @cyb3rops: Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026). Threat actor also hit http://derouter.ai, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched). New infra IOCs: 203.88.119[.]53 — new primary host post-migration 137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets) 143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic 207.180.56[.]150 — Operator's IP address Domains: 1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating) aitoday[.]me — second service Attribution: SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese. Shodan username via api key: crc2 @malwrhunterteam @500mk500 @MichalKoczwaraKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.