ctipilot.ch

Palo Alto PAN-OS Captive Portal unauthenticated root RCE (CVSS 9.3, ITW, KEV deadline 2026-05-09)

cve · CVE-2026-0300 single-source

Coverage timeline
6
first 2026-05-04 → last 2026-05-25
Peak priority
high
4 high · 2 notable
Sources cited
8
5 hosts
Sections touched
3
trending-vulnerabilities, updates, weekly-top-stories
Co-occurring entities
1
see Related entities below
ATT&CK techniques
4
pinned v19.1 · see below

Hunting pivots

Tags
actively-exploited ×6pre-auth ×6rce ×6vulnerabilities ×6cisa-kev ×4patch-available ×3nation-stateno-patch

ATT&CK techniques

4 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · ATT&CK page ↗

Privilege Escalation TA0004

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · ATT&CK page ↗

Stealth TA0005

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×1

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · ATT&CK page ↗

Command and Control TA0011

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · ATT&CK page ↗

Story timeline

  1. 2026-05-18CVE-2026-0300 PAN-OS Captive Portal — revised fix-release timelines for 10.2.13-h21 and 10.2.16-h7; wave-2 target remains 2026-05-28
    trending-vulnerabilities
  2. 2026-05-14CVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those builds
    trending-vulnerabilitiesCVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those
  3. 2026-05-13PAN-OS CVE-2026-0300 — first-wave patched builds released on 2026-05-13
    updates
  4. 2026-05-12Palo Alto PAN-OS CVE-2026-0300 — first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only option
    trending-vulnerabilities
  5. 2026-05-11PAN-OS CVE-2026-0300 — wave 2 confirmed delayed to 2026-05-28; eight build streams remain on mitigation-only for a further 11 days
    weekly-top-stories
  6. 2026-05-04CVE-2026-0300 — Palo Alto PAN-OS Captive Portal unauthenticated root RCE; CL-STA-1132 active since 2026-04-09; no patch until 2026-05-13
    weekly-top-stories

Where this entity is cited

  • trending-vulnerabilities3
  • weekly-top-stories2
  • updates1

Source distribution

  • attack.mitre.org4 (50%)
  • cert.europa.eu1 (12%)
  • cert.ssi.gouv.fr1 (12%)
  • security.paloaltonetworks.com1 (12%)
  • unit42.paloaltonetworks.com1 (12%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (8)

Entries about Palo Alto PAN-OS Captive Portal unauthenticated root RCE (CVSS 9.3, ITW, KEV deadline 2026-05-09) (6)

2026-05-18 · view entry permalink →

NOTABLECVE-2026-0300exploited

CVE-2026-0300 PAN-OS Captive Portal — revised fix-release timelines for 10.2.13-h21 and 10.2.16-h7; wave-2 target remains 2026-05-28

UPDATE (originally covered 2026-05-07 deep dive): The Palo Alto Networks PSIRT advisory for CVE-2026-0300 was revised on 2026-05-16 to update the per-build fix-release schedule: PAN-OS 10.2.13-h21 was retimed on 2026-05-16, 10.2.16-h7 on 2026-05-14. Both are commonly deployed LTS branches in large enterprise and government estates; PA-Series and VM-Series devices on those two specific builds remain mitigation-only.

The wave-2 patch target for the remaining outstanding builds remains 2026-05-28. No new exploitation evidence accompanied the revision; the actively-exploited posture (unauthenticated heap overflow in the User-ID Authentication Portal / Captive Portal service, CVSS 9.3, pre-auth root RCE) reported in prior briefs continues. Defender action: verify each PA / VM appliance's installed PAN-OS build against the advisory's per-version patch matrix; if the installed build is 10.2.13-h21 or 10.2.16-h7, confirm the Captive Portal / User-ID Authentication Portal mitigation (disable the feature if unused, or apply the published Threat Prevention rule) remains active until the wave-2 fix lands.

UPDATE (originally covered 2026-05-07 deep dive): The Palo Alto Networks PSIRT advisory for CVE-2026-0300 was revised on 2026-05-16 to update the per-build fix-release schedule: PAN-OS 10.2.13-h21 was retimed on 2026-05-16, 10.2.16-h7 on 2026-05-14.

ctipilot v2 brief (migrated)
vulnerability18 May 05:00Zsingle-sourceOpen finding ↗
Sources: Palo Alto Networks PSIRT — CVE-2026-0300

2026-05-14 · view entry permalink →

HIGHCVE-2026-0300exploited

CVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those builds

UPDATE (originally covered 2026-05-07 deep dive, last updated 2026-05-13): Palo Alto Networks PSIRT updated its CVE-2026-0300 advisory on 2026-05-13 to reflect first-wave patch availability but to also disclose a second patch wave with an ETA of 2026-05-28 for eight commonly-deployed build streams: PAN-OS 12.1.7, 11.2.4-h17, 11.2.12, 11.1.7-h6, 11.1.15, 10.2.7-h34, 10.2.13-h21 and 10.2.16-h7 (Palo Alto Networks PSIRT, updated 2026-05-13). Operators running any of those builds cannot patch yet; the interim mitigation — restrict User-ID Authentication Portal to trusted zones, or disable Captive Portal if unused — is the only option until 28 May. CL-STA-1132 in-the-wild exploitation continues; the cluster's tradecraft (EarthWorm / ReverseSocks5 tunnels, AD enumeration via firewall service account, deliberate log destruction) is unchanged from prior coverage (Unit 42 — Captive Portal Zero-Day, 2026-05-06).

The CISA KEV entry was updated on 2026-05-13 to note "Palo Alto has released a variety of patches"; the FCEB remediation deadline (2026-05-09) has already expired. Per PD-13 the KEV deadline is not the operational driver in CH/EU — the active-exploitation status, the affected-build delay, and the CL-STA-1132 attribution are. The wave-2 delay specifics are documented in the vendor PSIRT advisory and were not independently corroborated by HIGH-reliability third-party reporting in window; treat the eight-build "ETA 05/28" list as vendor-primary and verify against the live PSIRT entry before any rollout planning.

UPDATE (originally covered 2026-05-07 deep dive, last updated 2026-05-13): Palo Alto Networks PSIRT updated its CVE-2026-0300 advisory on 2026-05-13 to reflect first-wave patch availability but to also disclose a second patch wave with an ETA of 2026-05-28 for eight commonly-deployed build streams …

ctipilot v2 brief (migrated)
vulnerability14 May 05:00Zsingle-sourceOpen finding ↗
Sources: Palo Alto Networks PSIRT — CVE-2026-0300 · Unit 42 — Captive Portal Zero-Day, 2026-05-06

2026-05-13 · view entry permalink →

NOTABLECVE-2026-0300exploitedupdate

PAN-OS CVE-2026-0300 — first-wave patched builds released on 2026-05-13

UPDATE · originally covered Palo Alto PAN-OS CVE-2026-0300 — first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only option (2026-05-12)

Palo Alto Networks released the first wave of patched PAN-OS builds on 2026-05-13 for the actively-exploited Captive Portal pre-auth RCE, covering PAN-OS 10.2, 11.1, 11.2 and 12.1 (Palo Alto Networks PSIRT, last updated 2026-05-07; patch table confirmed 2026-05-13). Concretely: PAN-OS 12.1.4-h5 (2026-05-13) plus 12.1.7 (planned 2026-05-28); PAN-OS 11.2 multiple builds staged 2026-05-13–2026-05-28; PAN-OS 11.1 and 10.2 on a similar cadence. Prisma Access, Cloud NGFW and Panorama remain unaffected. Threat Prevention signature ID 510019 remains the interim control for any unpatched instance. The CISA KEV deadline of 2026-05-09 is — per the audience-applicability rule in the daily prompt — irrelevant for CH/EU jurisdiction; the operational driver is the active exploitation by CL-STA-1132 documented previously.

UPDATE (originally covered 2026-05-12): Palo Alto Networks released the first wave of patched PAN-OS builds on 2026-05-13 for the actively-exploited Captive Portal pre-auth RCE, covering PAN-OS 10.2, 11.1, 11.2 and 12.1 (Palo Alto Networks PSIRT, last updated 2026-05-07; patch table confirmed …

ctipilot v2 brief (migrated)
vulnerability13 May 05:00Zsingle-sourceOpen finding ↗
Sources: Palo Alto Networks PSIRT CVE-2026-0300, 2026-05-13

Earlier coverage (3)

2026-05-12HIGHexploitedPalo Alto PAN-OS CVE-2026-0300 — first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only optionPalo Alto PAN-OS CVE-2026-0300 — first patch wave now scheduled for 2026-05-13 per the vendor advisory. The PSIRT page (last update 2026-05-07) lists first-wave fixed builds with ETA 05/13 and a second wave around 2026-05-28; until the 05/13 builds ship the interim Threat Prevention signature 510019 and captive-portal source-IP restriction remain the only mitigations against the unauthenticated root RCE that exploitation clusters have been actively abusing (Palo Alto Networks PSIRT — CVE-2026-0300).2026-05-11HIGHexploitedPAN-OS CVE-2026-0300 — wave 2 confirmed delayed to 2026-05-28; eight build streams remain on mitigation-only for a further 11 daysPAN-OS CVE-2026-0300 patch wave 2 confirmed delayed to 2026-05-28 (PSIRT advisory updated 2026-05-16). Eight PAN-OS build streams (12.1.7, 11.2.4-h17, 11.2.12, 11.1.7-h6, 11.1.15, 10.2.7-h34, 10.2.13-h21, 10.2.16-h7) remain on mitigation-only for a further eleven days while limited-ITW exploitation continues against User-ID Authentication Portal exposed firewalls. (Palo Alto PSIRT CVE-2026-0300 · daily 2026-05-14 UPDATE)2026-05-04HIGHexploitedCVE-2026-0300 — Palo Alto PAN-OS Captive Portal unauthenticated root RCE; CL-STA-1132 active since 2026-04-09; no patch until 2026-05-13CVE-2026-0300 PAN-OS Captive Portal — KEV deadline 2026-05-09 expired with no patch available; CL-STA-1132 (China-nexus, Unit 42) active since 2026-04-09 against a vulnerability disclosed 2026-05-06. Patch window 2026-05-13 → 2026-05-28; the rogue-admin name pattern svc-health-check-NNNNNN and Python-based tunnelling implants under /var/tmp/linuxupdate and adjacent /var/tmp/linuxap / /tmp/.c paths are the surviving post-compromise hunting indicators. (Palo Alto PSIRT · CERT-EU Critical Advisory 2026-006 · daily 2026-05-07 · daily 2026-05-09 UPDATE)