ridhinva/panos-captive-portal-rceScanner: CVE-2026-0300 PAN-OS User-ID Captive Portal Buffer Overflow RCE — Python CLI for detecting actively exploited BOF vulnerability in Palo Alto firewalls (CISA KEV 2026-05-13)
Buffer overflow in User-ID Authentication Portal (Captive Portal) service of PAN-OS.
Unauthenticated attacker can execute code as root on affected Palo Alto Networks firewalls.
| Field | Value |
|---|---|
| CVE | CVE-2026-0300 |
| Severity | 🔴 CRITICAL (CVSS 9.8) |
| Product | Palo Alto Networks PAN-OS (PA-Series & VM-Series) |
| CISA KEV | ✅ Added 2026-05-13 |
| Attack Vector | Network, Unauthenticated |
| Impact | Remote Code Execution as root |
| Status | Versions |
|---|---|
| ❌ Vulnerable | PAN-OS 11.3 < 11.3.10, 11.2 < 11.2.12, 10.6 < 10.6.9, 10.5 < 10.5.10 |
| ✅ Fixed | PAN-OS 11.3.10+, 11.2.12+, 10.6.9+, 10.5.10+ |
requests (stdlib-friendly)# Clone the repository
git clone https://github.com/ridhinva/panos-captive-portal-rce.git
cd panos-captive-portal-rce
# Install dependencies
pip install requests
python3 panos_rce_scanner.py example.com
python3 panos_rce_scanner.py https://192.168.1.1
echo "fw1.company.com" > targets.txt
echo "fw2.company.com" >> targets.txt
python3 panos_rce_scanner.py targets.txt
python3 panos_rce_scanner.py --info
╔══════════════════════════════════════════════════╗
║ CVE-2026-0300 ║
║ PAN-OS User-ID Captive Portal Buffer Overflow RCE Scanner & Checker║
╚══════════════════════════════════════════════════╝
[*] Scanning 3 targets...
[!!] fw-vulnerable.company.com
-> Endpoint accessible: /auth1/ (200)
-> Endpoint accessible: /php_ping.php (200)
-> Endpoint accessible: /global-protect/login.esp (200)
[ -] fw-patched.company.com - No obvious exposure
[ -] 192.168.1.50 - No obvious exposure
[*] Scan complete
[*] Advisory: https://security.paloaltonetworks.com/CVE20260300
The scanner performs passive fingerprinting by checking for PAN-OS Captive Portal endpoints that are exposed on the management interface. Presence of these endpoints indicates the vulnerable service is accessible.
Checks performed:
| Endpoint | Description |
|---|---|
/auth1/ | User-ID Captive Portal auth endpoint |
/php_ping.php | Legacy PHP ping utility (often exposed) |
/global-protect/login.esp | GlobalProtect login portal |
⚠️ Note: This scanner only detects exposure of vulnerable endpoints. Actual exploitation requires separate PoC and manual verification.
| Source | Link |
|---|---|
| CISA KEV Catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| NVD Entry | https://nvd.nist.gov/vuln/detail/CVE-2026-0300 |
| Vendor Advisory | https://security.paloaltonetworks.com/CVE20260300 |
| Patch Details | https://security.paloaltonetworks.com/CVE20260300 |
For authorized security testing and educational purposes only.
Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.
Always obtain explicit written permission before scanning systems you do not own.
@c_y_p_h3r — Bug bounty hunter & security researcher
git checkout -b feature/amazing-check)git commit -m 'feat: add amazing check')git push origin feature/amazing-check)See CONTRIBUTING.md for details.
MIT License — see LICENSE for details.