--- title: Threat Brief: Exploitation of PAN-OS Captive Portal... description: Unit 42 details active exploitation of CVE-2026-0300, a buffer overflow zero-day in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows... canonical: https://daily.dev/posts/threat-brief-exploitation-of-pan-os-captive-portal-zero-day-for-unauthenticated-remote-code-executi-kiguoam38 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution | daily.dev og:description: Unit 42 details active exploitation of CVE-2026-0300, a buffer overflow zero-day in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows... og:url: https://daily.dev/posts/threat-brief-exploitation-of-pan-os-captive-portal-zero-day-for-unauthenticated-remote-code-executi-kiguoam38 og:image: https://api.daily.dev/og/posts/kIGuoAM38.png og:image:alt: Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution **[Unit 42](https://daily.dev/sources/unit42)** · 7 min read · 0 upvotes · 0 comments ## Summary Unit 42 details active exploitation of CVE-2026-0300, a buffer overflow zero-day in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows unauthenticated remote code execution with root privileges on PA-Series and VM-Series firewalls. A likely state-sponsored threat cluster (CL-STA-1132) exploited the vulnerability starting April 2026, injecting shellcode into nginx worker processes, deploying open-source tunneling tools (EarthWorm, ReverseSocks5), conducting Active Directory enumeration using stolen firewall credentials, and systematically destroying forensic evidence. Mitigations include restricting portal access to trusted zones, disabling it if unused, and enabling Threat ID 510019 with Advanced Threat Prevention. Indicators of compromise including C2 IPs, file paths, and tool hashes are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Palo Alto Networks warns of firewall RCE zero-day exploited in attacks](https://daily.dev/posts/palo-alto-networks-warns-of-firewall-rce-zero-day-exploited-in-attacks-zo4m3vufc) · BleepingComputer · 3 upvotes · 0 comments - [Palo Alto's firewall OS has been under attack from multiple ransomware groups since June](https://daily.dev/posts/palo-alto-s-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june-jzzdv3s3y) · The Register · 0 upvotes · 0 comments - [Zero-Day Exploitation of Vulnerability \(CVE-2026-20245\) in Cisco Catalyst SD-WAN Manager](https://daily.dev/posts/zero-day-exploitation-of-vulnerability-cve-2026-20245-in-cisco-catalyst-sd-wan-manager-iuhsybebg) · Google Cloud · 0 upvotes · 0 comments --- Tags: [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/threat-brief-exploitation-of-pan-os-captive-portal-zero-day-for-unauthenticated-remote-code-executi-kiguoam38) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution","url":"https://daily.dev/posts/threat-brief-exploitation-of-pan-os-captive-portal-zero-day-for-unauthenticated-remote-code-executi-kiguoam38","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/threat-brief-exploitation-of-pan-os-captive-portal-zero-day-for-unauthenticated-remote-code-executi-kiguoam38"},"datePublished":"2026-05-07T00:12:02.509Z","dateModified":"2026-05-13T14:12:10.727Z","description":"Unit 42 details active exploitation of CVE-2026-0300, a buffer overflow zero-day in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e50c0e833bcb038292c91b83c9e332c3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e50c0e833bcb038292c91b83c9e332c3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/threat-brief-exploitation-of-pan-os-captive-portal-zero-day-for-unauthenticated-remote-code-executi-kiguoam38","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"zero-day","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution"}]} ```