ctipilot.ch

CL-STA-1132

campaign · campaign:cl-sta-1132 single-source

CL-STA-1132 — likely state-sponsored exploitation cluster for CVE-2026-0300 (PAN-OS)

Coverage timeline
11
first 2026-05-04 → last 2026-05-14
Peak priority
high
4 high · 7 notable
Sources cited
21
17 hosts
Sections touched
8
active-threats, trending-vulnerabilities, updates
Co-occurring entities
1
see Related entities below
ATT&CK techniques
5
pinned v19.2 · see below
2026-05-0411 appearances2026-05-14

Hunting pivots

Tags
actively-exploited ×9pre-auth ×8rce ×8vulnerabilities ×8cisa-kev ×5nation-state ×4patch-available ×4espionage ×2no-patch ×2china-nexuslperansomwarezero-day

ATT&CK techniques

5 techniques observed across 2 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · 2026-05-04/cl-sta-1132-pan-os-cve-2026-0300-exploitation-cluster-disclo · ATT&CK page ↗

Privilege Escalation TA0004

T1055Process Injection×2

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · 2026-05-04/cl-sta-1132-pan-os-cve-2026-0300-exploitation-cluster-disclo · ATT&CK page ↗

Stealth TA0005

T1055Process Injection×2

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · 2026-05-04/cl-sta-1132-pan-os-cve-2026-0300-exploitation-cluster-disclo · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×2

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · 2026-05-04/cl-sta-1132-pan-os-cve-2026-0300-exploitation-cluster-disclo · ATT&CK page ↗

Discovery TA0007

T1018Remote System Discovery×1

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.

Evidence: 2026-05-04/cl-sta-1132-pan-os-cve-2026-0300-exploitation-cluster-disclo · ATT&CK page ↗

Command and Control TA0011

T1572Protocol Tunneling×2

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-05-04/cve-2026-0300-palo-alto-pan-os-captive-portal-unauthenticate · 2026-05-04/cl-sta-1132-pan-os-cve-2026-0300-exploitation-cluster-disclo · ATT&CK page ↗

Story timeline

  1. 2026-05-14CVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those builds
    trending-vulnerabilitiesCVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those
  2. 2026-05-13PAN-OS CVE-2026-0300 — first-wave patched builds released on 2026-05-13
    updates
  3. 2026-05-12Palo Alto PAN-OS CVE-2026-0300 — first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only option
    trending-vulnerabilities
  4. 2026-05-11PAN-OS CVE-2026-0300 — wave 2 confirmed delayed to 2026-05-28; eight build streams remain on mitigation-only for a further 11 days
    weekly-top-stories
  5. 2026-05-11PAN-OS CVE-2026-0300 — staged-patch arc spanning W19 and W20
    weekly-multi-day
  6. 2026-05-09CVE-2026-0300 — Palo Alto PAN-OS Captive Portal KEV deadline TODAY (2026-05-09); no patch exists; first patches expected 2026-05-13; CL-STA-1132 post-exploitation detail
    active-threatsCVE-2026-0300 — Palo Alto PAN-OS Captive Portal KEV deadline TODAY (2026-05-09); no patch exists; first patches expected 2026-05-13; CL-STA-1132
  7. 2026-05-04Mandiant M-Trends 2026
    weekly-annual-reports
  8. 2026-05-04Looking ahead — 2026-W19
    weekly-looking-ahead
  9. 2026-05-04CVE-2026-0300 — Palo Alto PAN-OS Captive Portal unauthenticated root RCE; CL-STA-1132 active since 2026-04-09; no patch until 2026-05-13
    weekly-top-stories
  10. 2026-05-04CL-STA-1132 (PAN-OS CVE-2026-0300 exploitation cluster, likely state-sponsored)
    weekly-long-running
  11. 2026-05-04CL-STA-1132 — PAN-OS CVE-2026-0300 exploitation cluster: disclosure-to-deadline-to-deadline-expiry inside the window
    weekly-multi-day

Where this entity is cited

  • weekly-multi-day2
  • weekly-top-stories2
  • trending-vulnerabilities2
  • weekly-long-running1
  • weekly-looking-ahead1
  • weekly-annual-reports1
  • active-threats1
  • updates1

Source distribution

  • attack.mitre.org5 (24%)
  • bishopfox.com1 (5%)
  • cert.europa.eu1 (5%)
  • cert.ssi.gouv.fr1 (5%)
  • cisa.gov1 (5%)
  • cloud.google.com1 (5%)
  • enisa.europa.eu1 (5%)
  • helpnetsecurity.com1 (5%)
  • other9 (43%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (21)

Entries about CL-STA-1132 (11)

2026-05-14 · view entry permalink →

HIGHCVE-2026-0300exploited

CVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those builds

UPDATE (originally covered 2026-05-07 deep dive, last updated 2026-05-13): Palo Alto Networks PSIRT updated its CVE-2026-0300 advisory on 2026-05-13 to reflect first-wave patch availability but to also disclose a second patch wave with an ETA of 2026-05-28 for eight commonly-deployed build streams: PAN-OS 12.1.7, 11.2.4-h17, 11.2.12, 11.1.7-h6, 11.1.15, 10.2.7-h34, 10.2.13-h21 and 10.2.16-h7 (Palo Alto Networks PSIRT, updated 2026-05-13). Operators running any of those builds cannot patch yet; the interim mitigation — restrict User-ID Authentication Portal to trusted zones, or disable Captive Portal if unused — is the only option until 28 May. CL-STA-1132 in-the-wild exploitation continues; the cluster's tradecraft (EarthWorm / ReverseSocks5 tunnels, AD enumeration via firewall service account, deliberate log destruction) is unchanged from prior coverage (Unit 42 — Captive Portal Zero-Day, 2026-05-06).

The CISA KEV entry was updated on 2026-05-13 to note "Palo Alto has released a variety of patches"; the FCEB remediation deadline (2026-05-09) has already expired. Per PD-13 the KEV deadline is not the operational driver in CH/EU — the active-exploitation status, the affected-build delay, and the CL-STA-1132 attribution are. The wave-2 delay specifics are documented in the vendor PSIRT advisory and were not independently corroborated by HIGH-reliability third-party reporting in window; treat the eight-build "ETA 05/28" list as vendor-primary and verify against the live PSIRT entry before any rollout planning.

UPDATE (originally covered 2026-05-07 deep dive, last updated 2026-05-13): Palo Alto Networks PSIRT updated its CVE-2026-0300 advisory on 2026-05-13 to reflect first-wave patch availability but to also disclose a second patch wave with an ETA of 2026-05-28 for eight commonly-deployed build streams …

ctipilot v2 brief (migrated)
vulnerability14 May 05:00Zsingle-sourceOpen finding ↗
Sources: Palo Alto Networks PSIRT — CVE-2026-0300 · Unit 42 — Captive Portal Zero-Day, 2026-05-06

2026-05-13 · view entry permalink →

NOTABLECVE-2026-0300exploitedupdate

PAN-OS CVE-2026-0300 — first-wave patched builds released on 2026-05-13

UPDATE · originally covered Palo Alto PAN-OS CVE-2026-0300 — first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only option (2026-05-12)

Palo Alto Networks released the first wave of patched PAN-OS builds on 2026-05-13 for the actively-exploited Captive Portal pre-auth RCE, covering PAN-OS 10.2, 11.1, 11.2 and 12.1 (Palo Alto Networks PSIRT, last updated 2026-05-07; patch table confirmed 2026-05-13). Concretely: PAN-OS 12.1.4-h5 (2026-05-13) plus 12.1.7 (planned 2026-05-28); PAN-OS 11.2 multiple builds staged 2026-05-13–2026-05-28; PAN-OS 11.1 and 10.2 on a similar cadence. Prisma Access, Cloud NGFW and Panorama remain unaffected. Threat Prevention signature ID 510019 remains the interim control for any unpatched instance. The CISA KEV deadline of 2026-05-09 is — per the audience-applicability rule in the daily prompt — irrelevant for CH/EU jurisdiction; the operational driver is the active exploitation by CL-STA-1132 documented previously.

UPDATE (originally covered 2026-05-12): Palo Alto Networks released the first wave of patched PAN-OS builds on 2026-05-13 for the actively-exploited Captive Portal pre-auth RCE, covering PAN-OS 10.2, 11.1, 11.2 and 12.1 (Palo Alto Networks PSIRT, last updated 2026-05-07; patch table confirmed …

ctipilot v2 brief (migrated)
vulnerability13 May 05:00Zsingle-sourceOpen finding ↗
Sources: Palo Alto Networks PSIRT CVE-2026-0300, 2026-05-13

2026-05-12 · view entry permalink →

HIGHCVE-2026-0300exploited

Palo Alto PAN-OS CVE-2026-0300 — first-wave fixed builds now scheduled for 2026-05-13; until then interim mitigation remains the only option

UPDATE (originally covered as the 2026-05-07 deep dive; updates 2026-05-08 → 2026-05-10): Palo Alto Networks' PSIRT page for CVE-2026-0300 (last updated 2026-05-07 at time of run) now lists first-wave fixed builds with an ETA of 2026-05-13 for several mainline branches and a second wave around 2026-05-28 for the remaining branches; no patched build is yet shipped against the unauthenticated root RCE in the User-ID Authentication Portal / Captive Portal service. The CL-STA-1132 cluster attribution and the ~2026-04-09 first-observed-exploitation date come from Unit 42's separate Captive Portal Zero-Day threat bulletin, not from the PSIRT advisory itself.

Operationally: until the 05/13 first-wave builds ship, the interim Threat Prevention signature 510019 plus source-IP restriction of the captive-portal interface to trusted internal ranges remain the only defender controls for branches that do not yet have a fixed build. PA-Series and VM-Series operators with User-ID Authentication Portal or Captive Portal exposed should treat tomorrow as a pre-staged deployment window — confirm a tested rollback path, validate the interim signature is enforced (Threat Prevention licence required), and verify the captive-portal listener is reachable only from authorised source ranges. Prisma Access, Cloud NGFW and Panorama are not affected. The CISA KEV deadline (2026-05-09) has already expired for FCEB agencies and per PD-13 does not drive Swiss/EU action framing on its own — the operational driver is the actively-exploited ITW status and the imminent first-wave patch ship date.

UPDATE (originally covered as the 2026-05-07 deep dive; updates 2026-05-08 → 2026-05-10): Palo Alto Networks' PSIRT page for CVE-2026-0300 (last updated 2026-05-07 at time of run) now lists first-wave fixed builds with an ETA of 2026-05-13 for several mainline branches and a second wave around …

ctipilot v2 brief (migrated)
vulnerability12 May 05:00Zmulti-sourceOpen finding ↗
Sources: Palo Alto Networks PSIRT — CVE-2026-0300 · Unit 42 — Captive Portal Zero-Day threat bulletin

Earlier coverage (8)

2026-05-11NOTABLEexploitedPAN-OS CVE-2026-0300 — staged-patch arc spanning W19 and W20The PAN-OS staged-patch arc began in W19 with limited-ITW exploitation against User-ID Authentication Portal exposed firewalls (CL-STA-1132 since 2026-04-09), continued into W20 with wave 1 landing on 2026-05-13 (daily 2026-05-13 UPDATE) for eight build streams, and now extends a further eleven days as the PSIRT …2026-05-11HIGHexploitedPAN-OS CVE-2026-0300 — wave 2 confirmed delayed to 2026-05-28; eight build streams remain on mitigation-only for a further 11 daysPAN-OS CVE-2026-0300 patch wave 2 confirmed delayed to 2026-05-28 (PSIRT advisory updated 2026-05-16). Eight PAN-OS build streams (12.1.7, 11.2.4-h17, 11.2.12, 11.1.7-h6, 11.1.15, 10.2.7-h34, 10.2.13-h21, 10.2.16-h7) remain on mitigation-only for a further eleven days while limited-ITW exploitation continues against User-ID Authentication Portal exposed firewalls. (Palo Alto PSIRT CVE-2026-0300 · daily 2026-05-14 UPDATE)2026-05-09NOTABLEexploitedCVE-2026-0300 — Palo Alto PAN-OS Captive Portal KEV deadline TODAY (2026-05-09); no patch exists; first patches expected 2026-05-13; CL-STA-1132 post-exploitation detailUPDATE (originally covered 2026-05-07):2026-05-04NOTABLELooking ahead — 2026-W19Canvas / Instructure extortion deadline — Tuesday 2026-05-12 (two days out). Second-intrusion claim against Instructure made 2026-05-08 despite the May 8 patches; seven Dutch universities disconnected; Dutch DPA and ICO engaged.2026-05-04NOTABLEexploitedCL-STA-1132 (PAN-OS CVE-2026-0300 exploitation cluster, likely state-sponsored)Current state: actively in-the-wild against internet-facing PAN-OS PA-Series / VM-Series firewalls since approximately 2026-04-09; the KEV deadline (2026-05-09) expired with no patch available and the staged patch window runs 2026-05-13 → 2026-05-28.2026-05-04NOTABLEMandiant M-Trends 2026M-Trends 2026 (published 2026-03-23, first covered 2026-05-07) reinforces three cross-cutting trends visible in this week's incidents: voice phishing surged to the second most prevalent initial-access vector at 11% (overtaking email phishing at 6%) driven by IT help-desk impersonation and SaaS OAuth token theft …2026-05-04NOTABLEexploitedCL-STA-1132 — PAN-OS CVE-2026-0300 exploitation cluster: disclosure-to-deadline-to-deadline-expiry inside the windowThe PAN-OS Captive Portal zero-day chain compressed an entire incident-response cycle into one ISO week. 2026-05-06 — Palo Alto disclosed CVE-2026-0300 (CVSS 9.3 unauthenticated root RCE); CERT-EU issued a rare Critical Advisory; CISA listed in KEV with deadline 2026-05-09; Unit 42 attributed active exploitation …2026-05-04HIGHexploitedCVE-2026-0300 — Palo Alto PAN-OS Captive Portal unauthenticated root RCE; CL-STA-1132 active since 2026-04-09; no patch until 2026-05-13CVE-2026-0300 PAN-OS Captive Portal — KEV deadline 2026-05-09 expired with no patch available; CL-STA-1132 (China-nexus, Unit 42) active since 2026-04-09 against a vulnerability disclosed 2026-05-06. Patch window 2026-05-13 → 2026-05-28; the rogue-admin name pattern svc-health-check-NNNNNN and Python-based tunnelling implants under /var/tmp/linuxupdate and adjacent /var/tmp/linuxap / /tmp/.c paths are the surviving post-compromise hunting indicators. (Palo Alto PSIRT · CERT-EU Critical Advisory 2026-006 · daily 2026-05-07 · daily 2026-05-09 UPDATE)