Public Exploit Code Is Now Circulating for a Root-Level Palo Alto Firewall Bug: CVE-2026-0300

PAN-OS is one of the most widely deployed enterprise firewall operating systems in the world, and on many networks the Palo Alto firewall is the line between the corporate side and the plant floor. CVE-2026-0300 turns a single unauthenticated packet to an exposed User-ID portal into root on that firewall. It was disclosed and exploited as a near zero-day in May. What surfaced this week is fresh public proof-of-concept code, which widens the pool of people who can run the attack.

What surfaced this week

The vulnerability itself is three months old. What is new is the maturity of the tooling around it, and that is the part worth watching. Public proof-of-concept code for CVE-2026-0300 first appeared in May, within days of disclosure — a single script, lightly documented, of the kind that surfaces after every headline CVE and often does not work.

The past several days look different. On August 6 a repository appeared carrying not just an exploit but a payload generator and a scanning script beside it, with a written walkthrough. The next day, a separate project that had sat mostly idle since May was rebuilt into a packaged scanner, with documentation, a licence, a security policy and continuous-integration checks. That is the difference between exploit code existing and exploit code being usable, and it is the transition that reliably precedes broader opportunistic exploitation.

Worth saying plainly: the scanner cuts both ways. A tool that tells an attacker which firewalls are still vulnerable tells a defender exactly the same thing about their own estate, and that is the more useful reading for anyone running PAN-OS this week.

We treat the exploit repositories as untrusted. We did not download or run any of them, and we make no claim about whether any specific repository produces a working exploit. Fake, broken, or booby-trapped proof-of-concept repositories are common for high-profile CVEs, which is itself a hazard worth naming: defenders and opportunists alike go looking for exploit code the moment a big vulnerability trends, and not all of what they find is what it claims to be. What we can say, at the level established sources have confirmed, is that public exploit material for CVE-2026-0300 now exists and is growing, and that the barrier to attempting this attack is lower this week than it was at disclosure.

What the appliance is, and why it matters

PAN-OS is the operating system that runs Palo Alto Networks Next-Generation Firewalls, both the PA-Series hardware appliances and the VM-Series virtual firewalls. These are among the most common enterprise firewalls in service. The affected component is the User-ID Authentication Portal, historically known as the Captive Portal. It is a non-default feature that maps IP addresses to usernames so the firewall can apply user-based and group-based policy, and when it is used to challenge users it presents a web response page. The exposure requires two conditions together: the Authentication Portal must be enabled, and its response pages must be reachable from an interface that untrusted or internet traffic can reach.

Rapid7's write-up put the scale plainly.

PAN-OS is among the most widely deployed enterprise firewall operating systems in the world.

Not every one of those internet-facing instances runs the Authentication Portal, and fewer still expose it to untrusted networks, so the exploitable population is a subset of that figure rather than the whole of it. But the base is very large, the feature is a simple checkbox away, and the payoff for an attacker who lands on a firewall is high. Prisma Access, Cloud NGFW, and Panorama are not affected.

How the vulnerability works

We describe the mechanics only at the conceptual level that vendor and reputable analyses have published, and we do not reproduce or run exploit code. CVE-2026-0300 is a buffer overflow, classified as CWE-787, an out-of-bounds write. In plain terms, the portal accepts attacker-supplied data and writes it into a fixed region of memory without properly checking that the data fits. The overflow spills past the end of the intended buffer and corrupts adjacent memory, the kind of memory that holds return addresses and function pointers that decide what the program does next. By shaping the overflowing input carefully, an attacker steers that corrupted control flow into code of their choosing.

Because the vulnerable code path is reached before any authentication, and because the portal service runs with high privilege on the firewall, a successful overflow yields code execution as root. There is no login step to get past and no user who has to click anything.

An unauthenticated, remote attacker executes arbitrary code with root privileges on an affected PA-Series or VM-Series firewall by sending specially crafted packets. That is the whole attack.

Who has been exploiting it

This is not, on the current evidence, a ransomware story, and we are not going to dress it up as one. The CISA KEV entry does not flag known ransomware use for CVE-2026-0300. Instead, Palo Alto Networks Unit 42 attributed the observed early exploitation to a cluster it tracks as CL-STA-1132, assessed as likely state-sponsored, which followed initial access on the firewall with open-source tunneling tools and Active Directory enumeration inside the victim network. That is a quieter and, in many ways, more deliberate kind of threat than commodity extortion: a capable actor using the firewall as a foothold to map and move through the network behind it.

The reason a public proof of concept changes the picture is that it decouples the vulnerability from that single well-resourced actor. Once working exploit code circulates, opportunistic scanners and lower-skilled operators can attempt the same unauthenticated path to root, and the target selection broadens from chosen victims to whatever is exposed and unpatched. The vulnerability is the same. The population of people who can pull the trigger is not.

Why a firewall lands on an OT and CI watch

We want to be precise about scope. PAN-OS is an IT security product, not an industrial control system, and CVE-2026-0300 is not an ICS advisory. We flag it under our operational technology and critical infrastructure watch for a specific and, we think, defensible reason. In the reference architectures that critical-infrastructure operators actually deploy, a next-generation firewall is very often the enforced boundary between the enterprise IT network and the operational network, the industrial demilitarized zone that segmentation models such as the Purdue model and IEC 62443 are built around. User-ID and the Authentication Portal are part of how organizations apply identity-aware policy at exactly those boundaries.

Root on that firewall collapses the boundary. An attacker with root can disable or blind logging, rewrite or relax the rules that separate the corporate side from the plant side, read VPN and management credentials, and use the box as a staging point to reach the operational network behind it. The whole security value of segmentation depends on the segmentation device not being an open door. An unauthenticated flaw that turns the firewall itself into attacker-controlled root is that door, opened. The exposure is real even though the flaw lives in an IT product, and we frame it as indirect rather than overstating it as a direct compromise of a controller or a sensor.

What we see from our sensors

We run a fleet of honeypots and edge decoys, and this vulnerability sits in our lane by category: it is reached by sending traffic to a web-facing service on an internet-exposed security appliance, exactly the reachability our edge decoys emulate. Two patterns in our first-party data speak directly to the risk around a bug like this — neither is a CVE-2026-0300 capture, and we are careful below not to imply otherwise.

The default credential gets sprayed relentlessly. admin / admin is the factory default on Palo Alto devices, and it is the same pair attackers try against nearly anything with a login. Of the 17,859 unique username-and-password pairs in our credential feed as of publication, 911 — 5.1 percent — contain admin. The bare admin/admin pair is in there too, seen on six separate sensors, alongside variants such as admin:admin01 and admin:admin123456 that appear far more often. In fairness to the vendor, PAN-OS has forced a password change at first login since 9.0.4, so a current, properly commissioned firewall should not be sitting on the default — but the spraying continues regardless, because enough devices somewhere still answer.

Edge-appliance probing, with scanners and reflection artifacts removed. About 8,000 source IPs hit our internet-facing firewall and VPN-gateway decoys, but we do not call all of them attackers. Roughly 2,000 are research or commercial scanners (Censys, Shadowserver, and, fittingly for this post, Palo Alto's own Cortex Xpanse among them), which we classify and publish separately. We also checked the SNMP-tagged subset for amplification-reflection victims — spoofed source addresses that are targets of an attack, not the attacker — and found only about 28 that appear over SNMP alone; the rest had also completed sessions on SSH, HTTP, or VPN services, which a spoofed address cannot. That leaves roughly 6,000 IPs we attribute to genuine adversarial probing of firewall and VPN surfaces — the population and reachability CVE-2026-0300 depends on, and traffic that reliably intensifies once public exploit code exists. Separating the internet's constant benign scanning from real adversaries is the whole point; conflating the two is how threat feeds inflate their numbers.

How to fix and contain it

Patch first. Because the early exploitation involved a capable actor establishing tunnels and enumerating the internal network, treat any firewall that was exposed and unpatched during the exposure window as potentially already reached, and hunt accordingly rather than assuming a clean patch closes the book.

• Upgrade to a fixed PAN-OS build. Match your release line to the fixed versions above, per the Palo Alto Networks advisory for CVE-2026-0300. Fixes shipped in two waves, on May 13 and May 28, 2026, so all fixed builds have been available for months. Prisma Access, Cloud NGFW, and Panorama are not affected.
• If you cannot patch immediately, cut the exposure. Restrict the User-ID Authentication Portal to trusted internal zones only, and on any interface where untrusted or internet traffic ingresses, disable the response pages that the portal presents. If the Authentication Portal is not required, disable it. Any one of these breaks the unauthenticated path from the internet to the vulnerable code.
• Confirm whether the portal is even on. This is a non-default feature. Check Device, User Identification, Authentication Portal Settings, and if you are not deliberately using it, the safest state is disabled.
• Assume the firewall may have been a foothold, and hunt. For appliances that were exposed and unpatched, review for unexpected outbound tunnels, new or unusual administrative activity, and signs of Active Directory enumeration originating from or pivoting through the firewall. Rotate management and VPN credentials associated with the device.
• Reduce the standing attack surface. Management and identity portals on an internet-facing firewall should be reachable only from where they are actually needed. The best-practice guidance to keep these interfaces off untrusted networks is the same control that most reduces exposure to the next bug of this shape.

Indicators and references