CVE-2026-0300 — PAN-OS User-ID Authentication Portal Buffer Overflow Exploit

Critical (CVSS 9.3) — Unauthenticated Remote Code Execution in Palo Alto Networks PAN-OS Captive Portal

Table of Contents

• Overview
• Vulnerability Details
• Affected Versions
• Architecture Diagrams
• Project Structure
• Installation
• Scanner Usage — Step by Step
• Exploit Usage — Step by Step
• Payload Design
• Mitigation
• Disclaimer

---

Overview

CVE-2026-0300 is a critical buffer overflow vulnerability in the User-ID Authentication Portal (also known as Captive Portal) service of Palo Alto Networks PAN-OS software. An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls.

This repository contains a proof-of-concept exploit toolkit including:

• Payload generator with version-specific offsets and x86_64 reverse shell shellcode
• Scanner to detect vulnerable Captive Portal targets
• Exploit with three modes: detection, crash (DoS), and full RCE

---

Vulnerability Details

Field	Value
CVE ID	CVE-2026-0300
Severity	CRITICAL
CVSS 4.0	9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H)
CWE	CWE-787: Out-of-bounds Write
CAPEC	CAPEC-100: Overflow Buffers
Impact	Unauthenticated Remote Code Execution (root)
Exploitation Status	Limited exploitation observed in the wild

Description

A buffer overflow vulnerability in the User-ID Authentication Portal service of PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall by sending specially crafted packets. The Captive Portal HTTP service uses fixed-size stack buffers for parsing HTTP headers, which can be overflowed via oversized header values (Cookie, User-Agent, URI, or POST body).

Required Configuration for Exposure

Both conditions must be true for a target to be vulnerable:

1. User-ID Authentication Portal enabled — Device > User Identification > Authentication Portal Settings > Enable Authentication Portal
2. Interface management profile with response pages — attached to an L3 interface in a zone where untrusted/internet traffic can ingress

Advisory Reference

• Official Advisory: https://security.paloaltonetworks.com/CVE-2026-0300
• Best Practice Guidelines: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CqbiCAC

---

Affected Versions

PAN-OS Branch	Vulnerable Versions	Fixed Version
10.2	10.2.7, 10.2.10, 10.2.13, 10.2.16, 10.2.18	10.2.7-h34+
11.1	11.1.0–11.1.14	11.1.15+
11.2	11.2.0–11.2.11	11.2.12+
12.1	12.1.0–12.1.6	12.1.7+

Not impacted: Prisma Access, Cloud NGFW, Panorama appliances.

---

Architecture Diagrams

System Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                    CVE-2026-0300 Exploit Toolkit                     │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  ┌────────────┐     ┌─────────────────┐     ┌────────────────────┐  │
│  │  scan.py   │────▶│  HTTP Fingerprint│     │  payload_gen.py    │  │
│  │  Scanner   │     │  + Version Check │     │                    │  │
│  └────────────┘     └─────────────────┘     │  ┌──────────────┐  │  │
│         │                                   │  │ Version      │  │  │
│         │  Reports:                         │  │ Offsets      │  │  │
│         │  • Portal detected?               │  │ (10.2/11.1/  │  │  │
│         │  • PAN-OS version                 │  │  11.2/12.1)  │  │  │
│         │  • Vulnerable?                    │  └──────────────┘  │  │
│         ▼                                   │  ┌──────────────┐  │  │
│  ┌────────────┐     ┌─────────────────┐     │  │ Shellcode    │  │  │
│  │ exploit.py │────▶│  Raw Socket     │     │  │ Generator    │  │  │
│  │  Exploit   │     │  HTTP Delivery  │     │  │ (x86_64 rev  │  │  │
│  └────────────┘     └─────────────────┘     │  │  shell)      │  │  │
│         │                                   │  └──────────────┘  │  │
│         │  ┌──────────────────────┐         │  ┌──────────────┐  │  │
│         ├─▶│ MODE: detect         │         │  │ ROP Chain    │  │  │
│         │  │ Safe, non-intrusive  │         │  │ (jmp rsp)    │  │  │
│         │  └──────────────────────┘         │  └──────────────┘  │  │
│         │  ┌──────────────────────┐         │  ┌──────────────┐  │  │
│         ├─▶│ MODE: crash          │         │  │ HTTP Request │  │  │
│         │  │ DoS validation       │         │  │ Builder      │  │  │
│         │  └──────────────────────┘         │  └──────────────┘  │  │
│         │  ┌──────────────────────┐         └────────────────────┘  │
│         └─▶│ MODE: rce            │                                   │
│            │ Reverse shell        │     ┌──────────────────────┐     │
│            └──────────────────────┘     │ ReverseShellListener │     │
│                    │                    │ (callback receiver)  │     │
│                    ▼                    └──────────────────────┘     │
│            ┌──────────────────┐                                      │
│            │  Target Firewall │                                      │
│            │  PAN-OS Captive  │                                      │
│            │  Portal Service  │                                      │
│            └──────────────────┘                                      │
└─────────────────────────────────────────────────────────────────────┘

Scanner Flow

┌─────────────┐
│  Start Scan │
└──────┬──────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Target reachable?│──────────▶│  Skip port  │
└──────┬───────────┘            └─────────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Send HTTP GET    │
│ to common ports  │
│ (443,80,8080,    │
│  8443,8843)      │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Captive Portal   │──────────▶│ Not exposed │
│ fingerprint?     │            └─────────────┘
│ (login.esp,      │
│  User-ID, PA-,   │
│  PAN-OS, etc.)   │
└──────┬───────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Extract PAN-OS   │
│ version from     │
│ Server header /  │
│ response body    │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Version in       │──────────▶│ Not         │
│ vulnerable       │            │ vulnerable  │
│ range?           │            └─────────────┘
└──────┬───────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Report:          │
│ • VULNERABLE     │
│ • Version        │
│ • Matched ranges │
│ • SSL cert info  │
└──────────────────┘

Exploit Flow (RCE Mode)