Palo Alto Networks PAN-OS Captive Portal flaw CVE-2026-0300 exploited to take over firewalls
Attackers exploited CVE-2026-0300 to take full control of Palo Alto Networks firewalls with exposed Captive Portals. Fixes are available. Ask your IT provider to update affected firewalls and investigate any previous exposure.
Ask whoever manages your office or family-office network to install a fixed PAN-OS release listed below and investigate previously exposed firewalls. Disable the Authentication Portal if unnecessary; otherwise restrict it to trusted networks and disable Response Pages on interfaces accepting untrusted traffic.
What’s happening
CVE-2026-0300 lets attackers run code with full administrator privileges through the Captive Portal on affected Palo Alto Networks PA-Series and VM-Series firewalls, without signing in. Unit 42 traced attempts to April and described limited, likely state-sponsored attacks that used firewall credentials to explore internal networks and erased logs. Palo Alto Networks disclosed the flaw in May; fixes followed in batches, with the second confirmed by NHS England on 1 June. Fixes now cover all four affected supported branches, including PAN-OS 12.1.7, whose release notes confirm the repair despite an old estimated date remaining in the advisory. Prisma Access, Cloud NGFW and Panorama are unaffected. The reviewed sources do not establish when attacks stopped.
- What
- Flaw
- Affects
- Palo Alto Networks PA-Series and VM-Series firewalls running PAN-OS
- Affected
- PA-Series and VM-Series firewalls with User-ID Authentication Portal enabled and Response Pages enabled on an interface accepting untrusted traffic.
PAN-OS 12.1 before 12.1.7, excluding fixed 12.1.4 hotfixes.
PAN-OS 11.2 before 11.2.12, excluding fixed hotfixes listed below.
PAN-OS 11.1 before 11.1.15, excluding fixed hotfixes listed below.
PAN-OS 10.2 before 10.2.18-h6, excluding fixed hotfixes listed below.
Older unsupported PAN-OS versions: vendor advises upgrading to a supported fixed release. - Fixed in
- PAN-OS 12.1.4-h5
PAN-OS 12.1.7
PAN-OS 11.2.4-h17
PAN-OS 11.2.7-h13
PAN-OS 11.2.10-h6
PAN-OS 11.2.12
PAN-OS 11.1.4-h33
PAN-OS 11.1.6-h32
PAN-OS 11.1.7-h6
PAN-OS 11.1.10-h25
PAN-OS 11.1.13-h5
PAN-OS 11.1.15
PAN-OS 10.2.7-h34
PAN-OS 10.2.10-h36
PAN-OS 10.2.13-h21
PAN-OS 10.2.16-h7
PAN-OS 10.2.18-h6 - Since
- 6 May 2026
- Closed
- 1 June 2026
Timeline
- New fixFixed
NHS England confirmed the second batch of updates had been released. The vendor lists fixed releases across all four affected supported branches.
- Vendor revised
Palo Alto Networks updated the release information for fixes 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12.
- New fixPartly fixed
NHS England reported that the first batch of PAN-OS fixes had been released; further releases were still outstanding.
- CISA added
CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities catalogue, the Canadian Centre for Cyber Security reported.
- Made publicNo fix yet
Palo Alto Networks published its advisory for CVE-2026-0300. No patches were initially available.
- Update
Attackers disrupted the compromised firewall and then compromised its standby partner when that device took over network traffic.
- Update
Unit 42 later traced unsuccessful attack attempts to 9 April. Attackers successfully compromised the targeted firewall a week later and erased evidence.
Sources
- CVE-2026-0300: PAN-OS User-ID Authentication Portal buffer overflowPalo Alto Networks · 28 May 2026
- PAN-OS 12.1.7 Addressed IssuesPalo Alto Networks
- Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code ExecutionPalo Alto Networks Unit 42 · 8 May 2026
- Palo Alto Networks security advisory (AV26-425) – Update 1Canadian Centre for Cyber Security · 6 May 2026
- Palo Alto Networks Releases Security Advisory for Critical Vulnerability in PAN-OSNHS England · 1 June 2026
- Palo Alto Networks warns of firewall RCE zero-day exploited in attacksBleepingComputer · 6 May 2026
- Palo Alto warns of critical software bug used in firewall attacksThe Record · 8 May 2026