CISA KEV Flash: 3 CVEs Added — Palo Alto, Linux Kernel & cPanel Under Active Attack

---
title: Potential Palo Alto PAN-OS Captive Portal Exploit (CVE-2026-0300)
id: 4a8c9d12-5e6f-4a3b-8c9d-12e6f4a3b8c9
description: Detects potential exploitation of OOB write in PAN-OS Captive Portal via suspicious web traffic patterns or anomalies.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://security.paloaltonetworks.com/
logsource:
    product: firewall
    service: pan-os
detection:
    selection:
        action|contains: 'deny'
        app|contains: 'captive-portal'
        threat_id|contains: 'possible-exploit'
    condition: selection
falsepositives:
    - Legitimate misconfigured captive portal attempts
level: critical
---
title: cPanel WHM Authentication Bypass Detection (CVE-2026-41940)
id: b9d0e1f2-6a7b-4c5d-9e0f-1a2b3c4d5e6f
description: Detects successful logins to cPanel/WHM without a referer or from unusual IP ranges, indicative of auth bypass.
status: experimental
date: 2026/04/30
author: Security Arsenal
references:
    - https://docs.cpanel.net/
logsource:
    product: web server
    service: access
detection:
    selection:
        cs_uri_stem|contains:
            - '/login/'
            - '/whm/'
        sc_status: 200
        cs_method: 'POST'
    filter_legit:
        cs_referer|contains: 'cpanel'
    condition: selection and not filter_legit
falsepositives:
    - Direct API tooling access
level: critical
---
title: Linux Kernel Privilege Escalation via Namespace Manipulation (CVE-2026-31431)
id: c1e2f3a4-7b8c-4d5e-8f9a-0b1c2d3e4f5a
description: Detects suspicious kernel module loading or namespace manipulation often associated with resource transfer LPE exploits.
status: experimental
date: 2026/05/01
author: Security Arsenal
references:
    - https://kernel.org/
logsource:
    product: linux
    service: auditd
detection:
    selection_syscall:
        type: 'SYSCALL'
        syscall|contains:
            - 'unshare'
            - 'setns'
        a0: '0x40000000' # CLONE_NEWUSER flag approximation
    selection_anomaly:
        type: 'AVC'
        comm|endswith: 'httpd' or comm|endswith: 'nginx'
    condition: 1 of selection*
falsepositives:
    - Legitimate container runtime operations (docker/podman)
level: high

// Hunt for Palo Alto Captive Portal anomalies (CVE-2026-0300)
PaloAltoCFW
| where Action in ("deny", "drop")
| where App has "captive-portal"
| project TimeGenerated, SourceIP, DestinationIP, Application, Action, ThreatID
| extend AnomalyScore = iff(ThreatID contains "buffer" or ThreatID contains "overflow", 1, 0)
| where AnomalyScore == 1
;
// Hunt for cPanel Auth Bypass (CVE-2026-41940)
Syslog
| where ProcessName contains "httpd" or ProcessName contains "cpanel"
| where SyslogMessage has "POST" and (SyslogMessage has "/login/" or SyslogMessage has "/whm/")
| parse SyslogMessage with * "status=" StatusCode:int " " *
| where StatusCode == 200
| where not(SyslogMessage has "Referer:")
| project TimeGenerated, HostName, SourceIP, SyslogMessage
;
// Hunt for Linux LPE (CVE-2026-31431)
LinuxAudit
| where Syscall in ("unshare", "setns", "clone")
| where Argv has "CLONE_NEWUSER"
| project TimeGenerated, HostName, Executable, Syscall, EventID, Argv
| summarize count() by HostName, Executable, bin(TimeGenerated, 5m)

#!/bin/bash
# Security Arsenal - Remediation Audit for CVE-2026-31431 & CVE-2026-41940
# Checks Linux Kernel Version and cPanel Version

echo "[+] Starting Vulnerability Audit..."

# 1. Check Linux Kernel for CVE-2026-31431
# (Simulated vulnerable ranges for 2026 context)
KERNEL_VERSION=$(uname -r)
VULN_KERNEL_PATTERN="^5\.1[0-4]|^6\.1$|6\.1\.[0-9]"

echo "[*] Checking Linux Kernel version: $KERNEL_VERSION"
if [[ $KERNEL_VERSION =~ $VULN_KERNEL_PATTERN ]]; then
    echo "[!] ALERT: System is running a vulnerable kernel version (CVE-2026-31431)."
else
    echo "[+] Kernel version appears safe based on current knowledge."
fi

# 2. Check cPanel Version for CVE-2026-41940
CPANEL_VERSION_FILE="/usr/local/cpanel/version"
if [ -f "$CPANEL_VERSION_FILE" ]; then
    CPANEL_VER=$(cat $CPANEL_VERSION_FILE)
    echo "[*] Checking cPanel version: $CPANEL_VER"
    # Simple check for versions below 118 (arbitrary example for patch)
    # In production, use official vendor check scripts
    if [[ "$CPANEL_VER" < "11.118.0.1" ]]; then
        echo "[!] ALERT: cPanel version is vulnerable to Auth Bypass (CVE-2026-41940)."
        echo "    Run: /usr/local/cpanel/scripts/upcp --force"
    else
        echo "[+] cPanel version appears patched."
    fi
else
    echo "[-] cPanel not detected."
fi

echo "[+] Audit complete."