CVE-2026-0300: Unauthenticated RCE in PAN-OS Captive Portal — Analysis & Mitigation

---
title: Potential Exploitation of PAN-OS Captive Portal CVE-2026-0300
id: 9a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation attempts against PAN-OS Captive Portal via suspicious URL patterns or high rate of 400/500 errors indicating fuzzing or buffer overflow attempts.
references:
 - https://unit42.paloaltonetworks.com/captive-portal-zero-day/
author: Security Arsenal
date: 2024/10/24
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: web
product: pa-firewall
detection:
 selection:
 c-uri|contains:
 - '/global-protect/portal/'
 - '/user-ID/'
 sc-status:
 - 400
 - 500
 condition: selection
falsepositives:
 - Legitimate misconfigured clients attempting to authenticate
level: high
---
title: Suspicious Shell Spawn from PAN-OS Web Services
id: b3c4d5e6-7f8a-9b0c-1d2e-3f4a5b6c7d8e
status: experimental
description: Detects the execution of a shell (sh/bash) spawned by the PAN-OS web management process, which is indicative of successful RCE.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2024/10/24
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
product: linux
detection:
 selection_parent:
 ParentImage|contains:
 - '/opt/pancfg/mgmt/bin/pan_task'
 - '/usr/bin/httpd'
 selection_image:
 Image|endswith:
 - '/sh'
 - '/bash'
 - '/nc'
 - '/telnet'
 condition: all of selection_*
falsepositives:
 - Administrative troubleshooting (rare)
level: critical

// Hunt for excessive error responses to Captive Portal endpoints
// which may indicate exploit attempts (fuzzing/buffer overflow)
Syslog
| where Vendor contains "Palo Alto"
| where ProcessName contains "PAN-OS" // Adjust based on your Syslog sourcetype setup
| parse Message with *"url=" URL:char *"code" ResponseCode:int ""* // Simple parsing for PAN syslog format
| where URL has "/global-protect/portal/" or URL has "/user-ID/"
| where ResponseCode in (400, 413, 500, 502)
| summarize count() by SourceIP, URL, bin(TimeGenerated, 5m)
| where count_ > 10
| project TimeGenerated, SourceIP, URL, count_
| sort by TimeGenerated desc

-- Hunt for suspicious processes spawned by web services on PAN-OS Management Plane
-- Note: This requires VQL agent access to the firewall management interface (rare, usually for VNFs)
SELECT Pid, Ppid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Name =~ 'sh'
  OR Name =~ 'bash'
  OR Name =~ 'nc'
  OR Name =~ 'python'
-- Check if parent is a known web process or management task
AND Ppid IN (
  SELECT Pid FROM pslist() WHERE Name =~ 'httpd' OR Name =~ 'pan_task' OR Name =~ 'mgmtsrvr'
)

#!/bin/bash
# CVE-2026-0300 Mitigation Script for PAN-OS
# NOTE: This script checks for the status of the Captive Portal service.
# Actual mitigation must be performed via the GUI or CLI to disable the feature.

echo "[+] Checking for listening Captive Portal/Web interfaces..."

# Check if the management process is listening on standard ports
# Adjust ports based on your specific configuration (443, 4443, etc.)
NETSTAT=$(which netstat) || NETSTAT=$(which ss) 

# Identify listening ports associated with web management
LISTENING_PORTS=$($NETSTAT -tuln | grep -E ':(443|4443|60443)' | grep LISTEN)

if [ -n "$LISTENING_PORTS" ]; then
    echo "[!] WARNING: Web interfaces detected listening."
    echo "$LISTENING_PORTS"
    echo ""
    echo "[!] ACTION REQUIRED:"
    echo "1. Disable the Captive Portal feature immediately if not essential."
    echo "2. Restrict management interface access (MGT) to trusted internal subnets only."
    echo "3. If User-ID is required, ensure it is not exposed to the Internet (Untrust zone)."
else
    echo "[+] No standard web management ports detected listening."
fi

echo "[+] Mitigation Check Complete."