{"id":"palo-alto-panos-captive-portal-may-2026","category":"patch","status":"closed","title":"Palo Alto Networks PAN-OS Captive Portal flaw CVE-2026-0300 exploited to take over firewalls","tldr":"Attackers exploited CVE-2026-0300 to take full control of Palo Alto Networks firewalls with exposed Captive Portals. Fixes are available. Ask your IT provider to update affected firewalls and investigate any previous exposure.","summary":"CVE-2026-0300 lets attackers run code with full administrator privileges through the Captive Portal on affected Palo Alto Networks PA-Series and VM-Series firewalls, without signing in. Unit 42 traced attempts to April and described limited, likely state-sponsored attacks that used firewall credentials to explore internal networks and erased logs. Palo Alto Networks disclosed the flaw in May; fixes followed in batches, with the second confirmed by NHS England on 1 June. Fixes now cover all four affected supported branches, including PAN-OS 12.1.7, whose release notes confirm the repair despite an old estimated date remaining in the advisory. Prisma Access, Cloud NGFW and Panorama are unaffected. The reviewed sources do not establish when attacks stopped.","action":"Ask whoever manages your office or family-office network to install a fixed PAN-OS release listed below and investigate previously exposed firewalls. Disable the Authentication Portal if unnecessary; otherwise restrict it to trusted networks and disable Response Pages on interfaces accepting untrusted traffic.","product":"Palo Alto Networks PA-Series and VM-Series firewalls running PAN-OS","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-0300"],"tags":["palo-alto-networks","pan-os","firewall","zero-day","remote-code-execution"],"affected":["PA-Series and VM-Series firewalls with User-ID Authentication Portal enabled and Response Pages enabled on an interface accepting untrusted traffic.","PAN-OS 12.1 before 12.1.7, excluding fixed 12.1.4 hotfixes.","PAN-OS 11.2 before 11.2.12, excluding fixed hotfixes listed below.","PAN-OS 11.1 before 11.1.15, excluding fixed hotfixes listed below.","PAN-OS 10.2 before 10.2.18-h6, excluding fixed hotfixes listed below.","Older unsupported PAN-OS versions: vendor advises upgrading to a supported fixed release."],"fixed":["PAN-OS 12.1.4-h5","PAN-OS 12.1.7","PAN-OS 11.2.4-h17","PAN-OS 11.2.7-h13","PAN-OS 11.2.10-h6","PAN-OS 11.2.12","PAN-OS 11.1.4-h33","PAN-OS 11.1.6-h32","PAN-OS 11.1.7-h6","PAN-OS 11.1.10-h25","PAN-OS 11.1.13-h5","PAN-OS 11.1.15","PAN-OS 10.2.7-h34","PAN-OS 10.2.10-h36","PAN-OS 10.2.13-h21","PAN-OS 10.2.16-h7","PAN-OS 10.2.18-h6"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-0300: PAN-OS User-ID Authentication Portal buffer overflow","url":"https://security.paloaltonetworks.com/CVE-2026-0300","by":"Palo Alto Networks","date":"2026-05-28"},{"kind":"advisory","title":"PAN-OS 12.1.7 Addressed Issues","url":"https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/pan-os-12-1-7-known-and-addressed-issues/pan-os-12-1-7-addressed-issues","by":"Palo Alto Networks","date":""},{"kind":"research","title":"Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution","url":"https://unit42.paloaltonetworks.com/captive-portal-zero-day/","by":"Palo Alto Networks Unit 42","date":"2026-05-08"},{"kind":"advisory","title":"Palo Alto Networks security advisory (AV26-425) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-425","by":"Canadian Centre for Cyber Security","date":"2026-05-06"},{"kind":"advisory","title":"Palo Alto Networks Releases Security Advisory for Critical Vulnerability in PAN-OS","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4777","by":"NHS England","date":"2026-06-01"},{"kind":"news","title":"Palo Alto Networks warns of firewall RCE zero-day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-actively-exploited-firewall-zero-day/","by":"BleepingComputer","date":"2026-05-06"},{"kind":"news","title":"Palo Alto warns of critical software bug used in firewall attacks","url":"https://therecord.media/palo-alto-warns-of-critical-software-bug-firewalls","by":"The Record","date":"2026-05-08"}],"started":"2026-05-06","closed":"2026-06-01","created":"2026-11-03T22:27:23.521Z","updated":"2026-11-03T22:27:23.521Z","cve_notes":[{"cve":"CVE-2026-0300","name":"Buffer overflow in PAN-OS Captive Portal","what":"A buffer overflow in the PAN-OS User-ID Authentication Portal lets an attacker who can reach the service run code as root on PA-Series and VM-Series firewalls without signing in.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-06-01","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"NHS England confirmed the second batch of updates had been released. The vendor lists fixed releases across all four affected supported branches.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4777","by":"NHS England","patch":"patched"},{"at":"2026-05-28","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Palo Alto Networks updated the release information for fixes 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12.","url":"https://security.paloaltonetworks.com/CVE-2026-0300","by":"Palo Alto Networks","patch":null},{"at":"2026-05-14","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"NHS England reported that the first batch of PAN-OS fixes had been released; further releases were still outstanding.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4777","by":"NHS England","patch":"partial"},{"at":"2026-05-06","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities catalogue, the Canadian Centre for Cyber Security reported.","url":"https://www.cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-425","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-05-05","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"Palo Alto Networks published its advisory for CVE-2026-0300. No patches were initially available.","url":"https://security.paloaltonetworks.com/CVE-2026-0300","by":"Palo Alto Networks","patch":"none"},{"at":"2026-04-29","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Attackers disrupted the compromised firewall and then compromised its standby partner when that device took over network traffic.","url":"https://unit42.paloaltonetworks.com/captive-portal-zero-day/","by":"Palo Alto Networks Unit 42","patch":null},{"at":"2026-04-09","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Unit 42 later traced unsuccessful attack attempts to 9 April. Attackers successfully compromised the targeted firewall a week later and erased evidence.","url":"https://unit42.paloaltonetworks.com/captive-portal-zero-day/","by":"Palo Alto Networks Unit 42","patch":null}],"url":"https://hard.fyi/live/palo-alto-panos-captive-portal-may-2026/","json":"https://hard.fyi/api/live?id=palo-alto-panos-captive-portal-may-2026"}