qassam-315/pan-os-user-id-buffer-overflow-pocA research-grade Proof-of-Concept (PoC) for CVE-2026-0300, targeting the Buffer Overflow vulnerability in Palo Alto Networks PAN-OS User-ID™ Authentication Portal (CWE-787).
CVE-2026-0300 is a high-severity buffer overflow vulnerability identified in the Palo Alto Networks PAN-OS User-ID™ Authentication Portal (Captive Portal). This research repository demonstrates the technical logic of the vulnerability, specifically focusing on how an unauthenticated network packet can lead to Remote Code Execution (RCE) with root privileges.
| Feature | Details |
|---|---|
| CVE ID | CVE-2026-0300 |
| Severity Score | 9.3 (Critical) |
| Weakness Type | CWE-787: Out-of-bounds Write |
| Attack Vector | Network (Unauthenticated) |
| Privileges Required | None |
| User Interaction | None |
| Affected Software | PAN-OS 12.1, 11.2, 11.1, 10.2 |
The vulnerability occurs when the User-ID Authentication Portal service fails to validate the length of incoming data before writing it to a memory buffer.
socket, struct, and argparse).git clone https://github.com/qassam-315/PAN-OS-CVE-2026-0300-Research.git
cd PAN-OS-CVE-2026-0300-Research
chmod +x research_poc.py
This tool is designed with a professional CLI (Command Line Interface).
python3 research_poc.py -t <TARGET_IP>
| Flag | Name | Description | Default |
|---|---|---|---|
| -t | --target | (Required) Target IP address of the firewall. | N/A |
| -p | --port | The port running the User-ID Portal. | 6082 |
| -o | --offset | The byte length to reach the memory overflow point. | 2048 |
| -r | --ret | The Hexadecimal return address. | 0xdeadbeef |
FOR EDUCATIONAL AND AUTHORIZED RESEARCH ONLY. Unauthorized testing against systems you do not own is illegal. The author is not responsible for any misuse of this research code. Use responsibly to improve global security. Developed By: qassam-315 Vulnerability Discovery Date: May 06, 2026