---
title: "PAN-OS CVE-2026-0300 and CVE-2026-0257: Exploited Portals"
url: https://erroneo.us/security/briefs/pan-os-cve-2026-0300-0257-captive-portal-globalprotect/
description: "Root RCE in the PAN-OS Captive Portal and a GlobalProtect auth bypass, both exploited; ransomware crews still use 0257. Upgrade past the May fixes now."
type: security-brief
section: "Security Digest"
date_published: 2026-05-05
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-0300", "CVE-2026-0257"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# PAN-OS CVE-2026-0300 and CVE-2026-0257: Exploited Portals

**Verdict: Act now.** Ransomware crews were still exploiting the GlobalProtect bypass in October 2026; any PAN-OS firewall not upgraded since May is exposed, so move it today to a build that also fixes CVE-2026-0322 and hunt the GlobalProtect logs.

- **Who must act:** Owners of PA-Series and VM-Series firewalls on PAN-OS 10.2 through 12.1 that use GlobalProtect authentication override cookies or expose the User-ID Authentication Portal, and have not upgraded since May 2026.
- **Who can relax:** Cloud NGFW and Panorama, which neither bug affects, and firewalls already on the October 2026 builds that fix CVE-2026-0322, which are later than the May fixes on every train.
- **Affected:** PAN-OS 12.1 before 12.1.7 (hotfixes 12.1.4-h5 for 0300, 12.1.4-h6 for 0257); PAN-OS 11.2 before 11.2.12 (hotfixes 11.2.10-h6/h7, 11.2.7-h13/h14, 11.2.4-h17); PAN-OS 11.1 before 11.1.15 (hotfixes 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33); PAN-OS 10.2 before 10.2.18-h6 (hotfixes 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34); Prisma Access 10.2 before 10.2.10-h36 and 11.2 before 11.2.7-h13 (CVE-2026-0257 only); CVE-2026-0300 needs the Authentication Portal plus response pages on an untrusted L3 interface; CVE-2026-0257 needs GlobalProtect authentication override cookies and a specific certificate setup
- **Fixed:** PAN-OS 12.1.7 or 12.1.4-h6; PAN-OS 11.2.12 or 11.2.10-h7, 11.2.7-h14, 11.2.4-h17; PAN-OS 11.1.15 or the 11.1 hotfixes listed by the vendor; PAN-OS 10.2.18-h6 or the 10.2 hotfixes listed by the vendor; Target now: the CVE-2026-0322 builds (12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 or the matching hotfix)
- **CVEs:** CVE-2026-0300, CVE-2026-0257
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run show system info on every PA-Series and VM-Series firewall and note sw-version.
2. Upgrade to the CVE-2026-0322 fixed build for your train, which also covers both May bugs, starting with firewalls running GlobalProtect or the Authentication Portal.
3. Upgrade all GlobalProtect portals and gateways together, and make sure enable-auth-override-cookie-hmac was not left set to no.
4. Give authentication override cookies their own certificate that no other function uses, or turn the feature off.
5. Restrict the User-ID Authentication Portal to trusted zones, disable response pages on untrusted interfaces, or disable the portal.
6. If either bug was reachable while unpatched, hunt with the Unit 42 indicators and open an incident.

### How to check if you are affected

- Search GlobalProtect logs for successful gateway-connected events from the Unit 42 IPs, such as 146.19.216.119, 179.43.172.213 and 202.144.192.47.
- Look for gateway-connected events with host IDs or names aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT, or with endpoint_os_version Microsoft Windows 10 Pro 64-bit and an empty domain.
- Check traffic to or from 67.206.213.86, 136.0.8.48, 146.70.100.69 and 149.104.66.84, tied to CVE-2026-0300 exploitation.
- Ask Palo Alto Networks support to check the firewall for /var/tmp/linuxap, /var/tmp/linuxda, /var/tmp/linuxupdate, /tmp/R5 and /var/R5, and for deleted nginx crash records.
- After a suspicious VPN session, review vCenter, ESXi and domain controller access from VPN address pools.

## What happened

On May 5, 2026, Palo Alto Networks published [CVE-2026-0300](https://security.paloaltonetworks.com/CVE-2026-0300), a buffer overflow (CWE-787) in the PAN-OS User-ID Authentication Portal, also called Captive Portal. An unauthenticated attacker who sends crafted packets can run code as root on PA-Series and VM-Series firewalls. The vendor scores it CVSS 4.0 9.3 when the portal faces the internet; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-0300) gives 9.8. The advisory reported "limited exploitation." Fixes shipped between May 13 and May 28, per the [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-paloalto-panos-cve-2026-0300-rce-20260506/) noted. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300) on May 6 with a May 9 deadline.

[Unit 42](https://unit42.paloaltonetworks.com/captive-portal-zero-day/) tied the attacks to CL-STA-1132, "a cluster of likely state-sponsored threat activity." Attempts began April 9. Once in, the attacker injected shellcode into an nginx worker, wiped crash records, deployed the EarthWorm and ReverseSocks5 tunnels, and enumerated Active Directory with credentials likely taken from the firewall.

On May 13, the vendor published [CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257), found internally. It is an authentication bypass in the GlobalProtect portal and gateway (CWE-565) that lets an attacker "establish an unauthorized VPN connection." The vendor scores it CVSS 4.0 7.8; NVD gives 9.1. A public proof of concept appeared on May 29. That day CISA added the bug to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257), due June 1, and marked ransomware use as known. On October 19, [Unit 42](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) said it "continues to observe attempted exploitation" by Qilin and Inc ransomware operators. The attackers bypassed MFA to open VPN sessions, then pivoted over RDP and SMB to vCenter and ESXi.

## Who is affected

Both bugs hit PAN-OS 10.2, 11.1, 11.2 and 12.1; 12.2 is not listed in either advisory. CVE-2026-0300 needs the Authentication Portal enabled, with response pages on an L3 interface that takes untrusted traffic. CVE-2026-0257 needs GlobalProtect authentication override cookies and "a specific certificate configuration"; it also hit Prisma Access 10.2 and 11.2. Panorama and Cloud NGFW are not affected. Fixed-version tables are on the [CVE-2026-0300](https://www.cve.org/CVERecord?id=CVE-2026-0300) and [CVE-2026-0257](https://www.cve.org/CVERecord?id=CVE-2026-0257) records.

## Do you really need to act?

If a firewall has not been upgraded since May, yes. Ransomware crews are still trying the VPN bypass, and a likely state-sponsored group used the portal bug for root access. A May or June upgrade covers these two. You still need October's [CVE-2026-0322](https://security.paloaltonetworks.com/CVE-2026-0322) builds, which are later on every train. The CVE-2026-0257 fix makes GlobalProtect users log in once more; the vendor's CLI switch that keeps legacy cookies during rollout must not be left on.

## What to do now

1. Run `show system info` on each firewall and note `sw-version`.
2. Upgrade to the CVE-2026-0322 build for your train (for example 12.1.10-h2, 11.2.16 or 10.2.18-h12), GlobalProtect firewalls first.
3. Upgrade all portals and gateways together. If you used `set global-protect enable-auth-override-cookie-hmac no` during the rollout, set it back to `yes`.
4. Give override cookies a dedicated certificate, never one reused from other functions.
5. Restrict the Authentication Portal to trusted zones and turn off response pages on untrusted interfaces, or disable the portal.

## How to tell if you were hit

Unit 42 says to search GlobalProtect logs for successful `gateway-connected` events from the nine IPs in its October 20 update, including `146.19.216.119`, `179.43.172.213` and `202.144.192.47`. Also search for host IDs or names `aa:bb:cc:dd:ee:ff`, `00:11:22:33:44:55`, `WINDOWS-LAPTOP-001`, `DESKTOP-GP01` and `GP-CLIENT`. Any match is an incident. For CVE-2026-0300, check traffic with `67.206.213.86`, `136.0.8.48`, `146.70.100.69` and `149.104.66.84`. Ask support to look for `/var/tmp/linuxap`, `/var/tmp/linuxupdate`, `/tmp/R5` or `/var/R5`, and for missing nginx crash records.

## Timeline

- Apr 9, 2026 — First failed CVE-2026-0300 exploit attempts, per Unit 42.
- May 5, 2026 — Palo Alto Networks publishes CVE-2026-0300.
- May 6, 2026 — CISA adds CVE-2026-0300 to KEV; Unit 42 publishes its threat brief.
- May 13, 2026 — CVE-2026-0257 is published; fixed builds roll out through May 28.
- May 29, 2026 — A public proof of concept appears; CISA adds CVE-2026-0257 to KEV.
- Oct 19, 2026 — Unit 42 adds Qilin and Inc ransomware activity to its CVE-2026-0257 brief.

## Sources

1. [Palo Alto Networks — CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID Authentication Portal](https://security.paloaltonetworks.com/CVE-2026-0300)
2. [Palo Alto Networks — CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities](https://security.paloaltonetworks.com/CVE-2026-0257)
3. [Unit 42 — Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution](https://unit42.paloaltonetworks.com/captive-portal-zero-day/)
4. [Unit 42 — Threat Brief: Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)
5. [CVE record — CVE-2026-0300](https://www.cve.org/CVERecord?id=CVE-2026-0300)
6. [CVE record — CVE-2026-0257](https://www.cve.org/CVERecord?id=CVE-2026-0257)
7. [NVD — CVE-2026-0300](https://nvd.nist.gov/vuln/detail/CVE-2026-0300)
8. [NVD — CVE-2026-0257](https://nvd.nist.gov/vuln/detail/CVE-2026-0257)
9. [CISA — Known Exploited Vulnerabilities: CVE-2026-0300](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0300)
10. [CISA — Known Exploited Vulnerabilities: CVE-2026-0257](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257)
11. [Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface](https://security.paloaltonetworks.com/CVE-2026-0322)
12. [Cloud Security Alliance — PAN-OS Captive Portal RCE: Zero-Auth Root Access Exploited](https://labs.cloudsecurityalliance.org/research/csa-research-note-paloalto-panos-cve-2026-0300-rce-20260506/)

---
Source page: https://erroneo.us/security/briefs/pan-os-cve-2026-0300-0257-captive-portal-globalprotect/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt