erroneo.us
Search all guides⌘K

Security Digest · May 5, 2026 · Vulnerability · Network edge

PAN-OS CVE-2026-0300 and CVE-2026-0257: Exploited Portals

Root RCE in the PAN-OS Captive Portal and a GlobalProtect auth bypass, both exploited; ransomware crews still use 0257. Upgrade past the May fixes now.

Published By erroneo.us Security Desk · Updated 3 min read12 sources

Our verdict

Act now

Ransomware crews were still exploiting the GlobalProtect bypass in October 2026; any PAN-OS firewall not upgraded since May is exposed, so move it today to a build that also fixes CVE-2026-0322 and hunt the GlobalProtect logs.

Who must act: Owners of PA-Series and VM-Series firewalls on PAN-OS 10.2 through 12.1 that use GlobalProtect authentication override cookies or expose the User-ID Authentication Portal, and have not upgraded since May 2026.

Who can relax: Cloud NGFW and Panorama, which neither bug affects, and firewalls already on the October 2026 builds that fix CVE-2026-0322, which are later than the May fixes on every train.

Affected
PAN-OS 12.1 before 12.1.7 (hotfixes 12.1.4-h5 for 0300, 12.1.4-h6 for 0257)
PAN-OS 11.2 before 11.2.12 (hotfixes 11.2.10-h6/h7, 11.2.7-h13/h14, 11.2.4-h17)
PAN-OS 11.1 before 11.1.15 (hotfixes 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33)
PAN-OS 10.2 before 10.2.18-h6 (hotfixes 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34)
Prisma Access 10.2 before 10.2.10-h36 and 11.2 before 11.2.7-h13 (CVE-2026-0257 only)
CVE-2026-0300 needs the Authentication Portal plus response pages on an untrusted L3 interface; CVE-2026-0257 needs GlobalProtect authentication override cookies and a specific certificate setup
Fixed in
PAN-OS 12.1.7 or 12.1.4-h6
PAN-OS 11.2.12 or 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
PAN-OS 11.1.15 or the 11.1 hotfixes listed by the vendor
PAN-OS 10.2.18-h6 or the 10.2 hotfixes listed by the vendor
Target now: the CVE-2026-0322 builds (12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 or the matching hotfix)
CVSS
9.3 (v4.0, vendor)
EPSS
96.9% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Run show system info on every PA-Series and VM-Series firewall and note sw-version.
  2. Upgrade to the CVE-2026-0322 fixed build for your train, which also covers both May bugs, starting with firewalls running GlobalProtect or the Authentication Portal.
  3. Upgrade all GlobalProtect portals and gateways together, and make sure enable-auth-override-cookie-hmac was not left set to no.
  4. Give authentication override cookies their own certificate that no other function uses, or turn the feature off.
  5. Restrict the User-ID Authentication Portal to trusted zones, disable response pages on untrusted interfaces, or disable the portal.
  6. If either bug was reachable while unpatched, hunt with the Unit 42 indicators and open an incident.

How to check if you are affected or compromised

  • Search GlobalProtect logs for successful gateway-connected events from the Unit 42 IPs, such as 146.19.216.119, 179.43.172.213 and 202.144.192.47.
  • Look for gateway-connected events with host IDs or names aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT, or with endpoint_os_version Microsoft Windows 10 Pro 64-bit and an empty domain.
  • Check traffic to or from 67.206.213.86, 136.0.8.48, 146.70.100.69 and 149.104.66.84, tied to CVE-2026-0300 exploitation.
  • Ask Palo Alto Networks support to check the firewall for /var/tmp/linuxap, /var/tmp/linuxda, /var/tmp/linuxupdate, /tmp/R5 and /var/R5, and for deleted nginx crash records.
  • After a suspicious VPN session, review vCenter, ESXi and domain controller access from VPN address pools.

What happened#

On May 5, 2026, Palo Alto Networks published CVE-2026-0300, a buffer overflow (CWE-787) in the PAN-OS User-ID Authentication Portal, also called Captive Portal. An unauthenticated attacker who sends crafted packets can run code as root on PA-Series and VM-Series firewalls. The vendor scores it CVSS 4.0 9.3 when the portal faces the internet; NVD gives 9.8. The advisory reported "limited exploitation." Fixes shipped between May 13 and May 28, per the Cloud Security Alliance noted. CISA added it to KEV on May 6 with a May 9 deadline.

Unit 42 tied the attacks to CL-STA-1132, "a cluster of likely state-sponsored threat activity." Attempts began April 9. Once in, the attacker injected shellcode into an nginx worker, wiped crash records, deployed the EarthWorm and ReverseSocks5 tunnels, and enumerated Active Directory with credentials likely taken from the firewall.

On May 13, the vendor published CVE-2026-0257, found internally. It is an authentication bypass in the GlobalProtect portal and gateway (CWE-565) that lets an attacker "establish an unauthorized VPN connection." The vendor scores it CVSS 4.0 7.8; NVD gives 9.1. A public proof of concept appeared on May 29. That day CISA added the bug to KEV, due June 1, and marked ransomware use as known. On October 19, Unit 42 said it "continues to observe attempted exploitation" by Qilin and Inc ransomware operators. The attackers bypassed MFA to open VPN sessions, then pivoted over RDP and SMB to vCenter and ESXi.

Who is affected#

Both bugs hit PAN-OS 10.2, 11.1, 11.2 and 12.1; 12.2 is not listed in either advisory. CVE-2026-0300 needs the Authentication Portal enabled, with response pages on an L3 interface that takes untrusted traffic. CVE-2026-0257 needs GlobalProtect authentication override cookies and "a specific certificate configuration"; it also hit Prisma Access 10.2 and 11.2. Panorama and Cloud NGFW are not affected. Fixed-version tables are on the CVE-2026-0300 and CVE-2026-0257 records.

Do you really need to act?#

If a firewall has not been upgraded since May, yes. Ransomware crews are still trying the VPN bypass, and a likely state-sponsored group used the portal bug for root access. A May or June upgrade covers these two. You still need October's CVE-2026-0322 builds, which are later on every train. The CVE-2026-0257 fix makes GlobalProtect users log in once more; the vendor's CLI switch that keeps legacy cookies during rollout must not be left on.

What to do now#

  1. Run show system info on each firewall and note sw-version.
  2. Upgrade to the CVE-2026-0322 build for your train (for example 12.1.10-h2, 11.2.16 or 10.2.18-h12), GlobalProtect firewalls first.
  3. Upgrade all portals and gateways together. If you used set global-protect enable-auth-override-cookie-hmac no during the rollout, set it back to yes.
  4. Give override cookies a dedicated certificate, never one reused from other functions.
  5. Restrict the Authentication Portal to trusted zones and turn off response pages on untrusted interfaces, or disable the portal.

How to tell if you were hit#

Unit 42 says to search GlobalProtect logs for successful gateway-connected events from the nine IPs in its October 20 update, including 146.19.216.119, 179.43.172.213 and 202.144.192.47. Also search for host IDs or names aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. Any match is an incident. For CVE-2026-0300, check traffic with 67.206.213.86, 136.0.8.48, 146.70.100.69 and 149.104.66.84. Ask support to look for /var/tmp/linuxap, /var/tmp/linuxupdate, /tmp/R5 or /var/R5, and for missing nginx crash records.

Timeline#

  • — First failed CVE-2026-0300 exploit attempts, per Unit 42.
  • — Palo Alto Networks publishes CVE-2026-0300.
  • — CISA adds CVE-2026-0300 to KEV; Unit 42 publishes its threat brief.
  • — CVE-2026-0257 is published; fixed builds roll out through May 28.
  • — A public proof of concept appears; CISA adds CVE-2026-0257 to KEV.
  • — Unit 42 adds Qilin and Inc ransomware activity to its CVE-2026-0257 brief.

Vulnerability records

  • CVE-2026-0300 · KEV 2026-05-06 · A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an…
  • CVE-2026-0257 · KEV 2026-05-29 · Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Palo Alto Networks — CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID Authentication Portal security.paloaltonetworks.com
  2. Palo Alto Networks — CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities security.paloaltonetworks.com
  3. Unit 42 — Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution unit42.paloaltonetworks.com
  4. Unit 42 — Threat Brief: Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) unit42.paloaltonetworks.com
  5. CVE record — CVE-2026-0300 cve.org
  6. CVE record — CVE-2026-0257 cve.org
  7. NVD — CVE-2026-0300 nvd.nist.gov
  8. NVD — CVE-2026-0257 nvd.nist.gov
  9. CISA — Known Exploited Vulnerabilities: CVE-2026-0300 cisa.gov
  10. CISA — Known Exploited Vulnerabilities: CVE-2026-0257 cisa.gov
  11. Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface security.paloaltonetworks.com
  12. Cloud Security Alliance — PAN-OS Captive Portal RCE: Zero-Auth Root Access Exploited labs.cloudsecurityalliance.org