🎯 CVE-2026-0300 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2026-0300 深度技术分析
📊 聚合 4 来源🧪 含 PoC🕵️ 含指纹
NVD-LatestCISA-KEVPoC-in-GitHubHorizon3 Blog
摘要：CVE-2026-0300 是 Palo Alto Networks PAN-OS 中 User-ID™ Authentication Portal（即 Captive Portal）服务的一个严重缓冲区溢出漏洞，CVSS 评分高达 9.8。未经认证的远程攻击者可通过发送特制数据包，在 PA-Series 与 VM-Series 防火墙上以 root 权限执行任意代码。该漏洞已入选 CISA KEV 已知被利用漏洞目录，目前尚无官方补丁的版本已被积极利用。Prisma Access、Cloud NGFW 与 Panorama 设备不受影响。
📌 漏洞概述
CVE-2026-0300 是一个位于 PAN-OS User-ID™ Authentication Portal（以下简称 Captive Portal）服务中的越界写入（Out-of-bounds Write）漏洞，属于典型的缓冲区溢出类型。CVSS v3.1 基础评分为 9.8（Critical），攻击向量为网络（Network），攻击复杂度低（Low），无需任何权限与用户交互，即可对目标设备造成机密性、完整性与可用性的完全破坏。
受影响的设备包括运行受影响 PAN-OS 版本的 PA-Series 硬件防火墙与 VM-Series 虚拟防火墙。Palo Alto Networks 官方在安全通告中指出，如果管理员按照最佳实践指南限制 User-ID™ Authentication Portal 仅对可信内部 IP 开放，则风险可大幅降低。此外，Prisma Access、Cloud NGFW 及 Panorama 管理设备不受该漏洞影响。
该漏洞已被美国 CISA 列入 Known Exploited Vulnerabilities（KEV）目录，CISA 要求联邦机构在指定期限内完成缓解或修复，说明该漏洞已在野外被利用，具备现实威胁。
🔬 漏洞根因分析
User-ID™ Authentication Portal 是 PAN-OS 中用于用户身份认证的强制门户（Captive Portal）服务。当终端用户尚未通过身份验证时，防火墙会将其 HTTP/HTTPS 请求重定向到认证门户，用户提交凭证后由该服务处理后端 RADIUS/LDAP 认证并向防火墙同步用户-IP 映射。该服务通常监听在 TCP 端口 6082（明文 HTTP）或 6083（TLS 加密），也可通过策略将端口重定向至 80/443。
从披露的技术细节与公开 PoC 仓库（如 ridhinva/panos-captive-portal-rce、lu4m575/CVE-2026-0300、sam00/POC-CVE-2026-0300-exploit）的利用原理推断，漏洞根因位于 Captive Portal 服务对特定 HTTP 请求头部或参数的解析逻辑中。攻击者可以构造包含超长字段的请求，例如畸形的 Host、Content-Length、Cookie，或自定义的 User-Agent 头，触发服务将数据复制到固定大小的栈或堆缓冲区时发生越界写入。
缓冲区溢出发生在内存拷贝操作中，缺少对输入长度的充分校验。当攻击者提供的字段长度超过目标缓冲区容量时，数据会覆盖相邻内存区域，包括函数返回地址、栈基址指针（RBP/RSP）或堆元数据。由于该服务以root 权限运行在防火墙的数据平面上，攻击者可以利用经典的控制流劫持技术——例如栈溢出覆盖返回地址，并借助 ROP（Return-Oriented Programming）链绕过 NX/DEP 等缓解机制——最终执行任意系统命令。在公开 PoC 的扫描模式下，攻击者通常先发送探测数据包判断目标是否存在漏洞，一旦确认漏洞存在，即可投递完整的漏洞利用载荷，实现以 root 身份注入命令、写入文件或启动反向 Shell。
需要特别指出的是，该漏洞无需任何用户交互，攻击者只需要能够从网络层到达 Captive Portal 服务端口，即可触发溢出。这也是其 CVSS 评分达到 9.8 的原因——利用条件非常简单，影响却是防火墙系统的完全失陷。此外，Captive Portal 通常是防火墙主动开放的服务，在默认配置中若未限制源 IP，将直接暴露给内网甚至外网，进一步扩大了攻击面。
💥 影响与危害
成功利用 CVE-2026-0300 可导致以下严重后果：
- 远程代码执行（RCE）：攻击者可以在目标防火墙上以 root 权限执行任意命令，完全控制设备操作系统。
- 防火墙失陷即内网沦陷：防火墙是所有内网流量的核心网关，一旦被控制，攻击者可读取、篡改、重定向南北向流量，进而渗透内部网络。同时可禁用安全策略、关闭日志审计，为后续持久化攻击创造有利条件。
- 数据窃取与篡改：攻击者可获取 VPN 配置、用户凭证、路由表、策略规则及会话内容，甚至解密已记录的 TLS 流量（若配置了解密功能）。
- 可用性破坏：通过覆盖关键内存结构或直接触发 crash，可导致 Captive Portal 服务崩溃，甚至整个防火墙控制平面/数据平面重启，造成业务中断。
- 内网横向移动跳板：被攻破的防火墙可作为跳板，利用已建立的安全通道（如 IPSec VPN）横向移动至其他受保护网络段。
由于该漏洞已在野外被利用（CISA KEV 收录），且存在公开的 PoC/扫描器，攻击者的门槛已被极大降低。安全团队必须将其视为紧急高危事件处理，而不是常规的“可计划修复”漏洞。
🛡️ 修复与缓解
针对 CVE-2026-0300，Palo Alto Networks 已发布相应的安全补丁，具体修复版本请参考官方安全通告（CVE-2026-0300 PAN-OS Security Advisory）并升级至包含修复的 PAN-OS 版本。在升级之前或在无法立即安装补丁的环境中，应采取以下缓解措施：
- 升级修复版本：优先在所有受影响 PA-Series/VM-Series 设备上升级至官方公告中列出的已修复 PAN-OS 版本。升级操作应在变更窗口内执行，并在升级后验证防火墙策略、VPN 及认证服务正常。
- 严格限制访问来源：根据最佳实践，仅允许受信任的内部 IP 访问 User-ID™ Authentication Portal。通过安全策略限制源地址，避免该服务暴露给不可信网络。若业务允许，建议仅允许来自特定用户网段或管理子网的 IP 访问 TCP 6082/6083 端口。
- 禁用不必要的服务：如果当前环境未使用 User-ID™ Authentication Portal，请立即在设备上禁用该功能。默认配置中如果未启用认证门户，则不会监听相关端口，攻击面自然消除。
- 启用威胁防护与入侵防御：在边界防火墙上启用 IPS/威胁检测签名，及时更新威胁库，以尝试拦截针对该漏洞的利用尝试。
- 监控可疑行为：检查防火墙日志中是否存在大量发往 Captive Portal 端口的异常请求，留意包含超长字段的 HTTP 请求、异常 User-Agent 或重复的探测模式。同时关注设备 CPU 占用、进程崩溃记录及异常系统行为。
- 参考 CISA BOD 22-01：联邦机构应按照 CISA 要求，在截止日期前完成缓解或修复，并依法报告利用活动。所有组织都应将此漏洞纳入漏洞管理流程的 P0 级别，并尽快响应。
🧪 PoC 复现
从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。
📋 代码元数据语言md来源ridhinva/panos-captive-portal-rce针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明
# CVE-2026-0300 — PAN-OS User-ID Captive Portal Buffer Overflow RCE Scanner
<p align="center"><a href="https://github.com/ridhinva/panos-captive-portal-rce/stargazers"><img src="https://img.shields.io/github/stars/ridhinva/panos-captive-portal-rce?style=for-the-badge" alt="Stars"></a>
<a href="https://github.com/ridhinva/panos-captive-portal-rce/network/members"><img src="https://img.shields.io/github/forks/ridhinva/panos-captive-portal-rce?style=for-the-badge" alt="Forks"></a>
<a href="https://github.com/ridhinva/panos-captive-portal-rce/issues"><img src="https://img.shields.io/github/issues/ridhinva/panos-captive-portal-rce?style=for-the-badge" alt="Issues"></a>
<a href="https://github.com/ridhinva/panos-captive-portal-rce/blob/main/LICENSE"><img src="https://img.shields.io/github/license/ridhinva/panos-captive-portal-rce?style=for-the-badge" alt="License"></a>
<a href="https://github.com/ridhinva/panos-captive-portal-rce/commits/main"><img src="https://img.shields.io/github/last-commit/ridhinva/panos-captive-portal-rce?style=for-the-badge" alt="Last Commit"></a>
<a href="https://github.com/ridhinva/panos-captive-portal-rce/actions"><img src="https://img.shields.io/github/actions/workflow/status/ridhinva/panos-captive-portal-rce/ci.yml?style=for-the-badge" alt="Build Status"></a><img src="https://img.shields.io/badge/CVE-2026--0300-CRITICAL-red?style=for-the-badge" alt="CVE">
<img src="https://img.shields.io/badge/CISA%20KEV-2026--05--13-orange?style=for-the-badge" alt="CISA KEV"><img src="https://img.shields.io/badge/Python-3.8+-blue?style=for-the-badge&logo=python" alt="Python"><img src="https://img.shields.io/badge/Platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey?style=for-the-badge" alt="Platform"></p>
---
## 🎯 Overview
**Buffer overflow in User-ID Authentication Portal (Captive Portal) service of PAN-OS.**
Unauthenticated attacker can execute code as **root** on affected Palo Alto Networks firewalls.
|Field |Value ||-------|-------||**CVE** |CVE-2026-0300 ||**Severity** |🔴 **CRITICAL** (CVSS 9.8) ||**Product** |Palo Alto Networks PAN-OS (PA-Series &VM-Series) ||**CISA KEV** |
✅ Added 2026-05-13 ||**Attack Vector** |Network,Unauthenticated ||**Impact** |Remote Code Execution as root |### Affected Versions
|Status |Versions ||--------|----------||❌ **Vulnerable** |PAN-OS 11.3 <11.3.10,11.2 <11.2.12,10.6 <10.6.9,10.5 <10.5.10 ||✅ **Fixed** |PAN-OS 11.3.10+,11.2.12+,10.6.9+,10.5.10+ |
---
## ✨ Features
- 🔍 **Fast scanning** — Concurrent multi-target scanning (20 workers default)
- 🎯 **Targeted checks** — PAN-OS specific endpoint detection
- 📊 **Multiple input modes** — Single target,file list,or CIDR ranges
- 📝 **Detailed output** — Vulnerable endpoints,status codes,response analysis
- 🛡️ **Safe by default** — Read-only checks,
no exploitation
- 📦 **Zero dependencies** — Only `requests` (stdlib-friendly)
---
## 🚀 Quick Start
### Installation
```bash
# Clone the repository
git clone https://github.com/ridhinva/panos-captive-portal-rce.git
cd panos-captive-portal-rce
# Install dependencies
pip install requests
```
### Usage
#### Scan a single target
```bash
python3 panos_rce_scanner.py example.com
python3 panos_rce_scanner.py https://192.168.1.1
```
#### Mass scan from file
```bash
echo "fw1.company.com" >
targets.txt
echo "fw2.company.com" >>targets.txt
python3 panos_rce_scanner.py targets.txt
```
#### Show vulnerability information
```bash
python3 panos_rce_scanner.py --info
```
---
## 📋 Example Output
```
╔══════════════════════════════════════════════════╗
║ CVE-2026-0300 ║
║ PAN-OS User-ID Captive Portal Buffer Overflow RCE Scanner &
Checker║
╚══════════════════════════════════════════════════╝
[*] Scanning 3 targets...
[!!] fw-vulnerable.company.com
->Endpoint accessible: /auth1/ (200)
->Endpoint accessible: /php_ping.php (200)
->
Endpoint accessible: /global-protect/login.esp (200)
[ -] fw-patched.company.com - No obvious exposure
[ -] 192.168.1.50 - No obvious exposure
[*] Scan complete
[*] Advisory: https://security.paloaltonetworks.com/CVE20260300
```
---
## 🔧 How It Works
The scanner performs **passive fingerprinting** by checking for PAN-OS Captive Portal endpoints that are exposed on the management interface. Presence of these endpoints indicates the vulnerable service is accessible.
**Checks performed:**
|
Endpoint |Description ||----------|-------------||`/auth1/` |User-ID Captive Portal auth endpoint ||`/php_ping.php` |Legacy PHP ping utility (often exposed) ||`/global-protect/login.esp` |GlobalProtect login portal |>⚠️ **Note:** This scanner only detects *exposure* of vulnerable endpoints. Actual exploitation requires separate PoC and manual verification.
---
## 📚 References
|Source |Link |
|--------|------||**CISA KEV Catalog** |<https://www.cisa.gov/known-exploited-vulnerabilities-catalog>||**NVD Entry** |<https://nvd.nist.gov/vuln/detail/CVE-2026-0300>||**Vendor Advisory** |<https://security.paloaltonetworks.com/CVE20260300>||**Patch Details** |<https://security.paloaltonetworks.com/CVE20260300>|---
## ⚖️ Disclaimer
>
**For authorized security testing and educational purposes only.**
>Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.
>Always obtain explicit written permission before scanning systems you do not own.
---
## 👤 Author
**[@c_y_p_h3r](https://x.com/c_y_p_h3r)** — Bug bounty hunter &
security researcher
---
## 🤝 Contributing
1. Fork the repository
2. Create a feature branch (`git checkout -b feature/amazing-check`)
3. Commit your changes (`git commit -m 'feat: add amazing check'`)
4. Push to the branch (`git push origin feature/amazing-check`)
5. Open a Pull Request
See [CONTRIBUTING.md](CONTRIBUTING.md) for details.
---
## 📄 License
MIT License — see [LICENSE](LICENSE) for details.⚔️ EXP 利用代码
截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。
🕵️ 检测指纹
针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。
🛡️ Semgrep 审计规则: CVE-2026-0300.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2026-0300.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2026-0300.yaml
rules:
- id: CVE-2026-0300-bo-c
languages: [c]
severity: ERROR
message: Potential out-of-bounds write in PAN-OS User-ID Authentication Portal (Captive Portal) service - CVE-2026-0300
patterns:
- pattern: memcpy($DST,$SRC,$N)
- pattern-not: memcpy($DST,$SRC,
sizeof($DST))
fix: "// Ensure destination buffer size is validated before memcpy\nif ($N <= sizeof($DST)) {\n memcpy($DST,$SRC,
$N);\n}"
metadata:
cwe: "CWE-787"
owasp: "A3: Injection"
technology: palo-alto-panos
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-0300"
- "https://security.paloaltonetworks.com/CVE-2026-0300"
- id: CVE-2026-0300-bo-cpp
languages: [cpp]
severity: ERROR
message: Potential out-of-bounds write in PAN-OS User-ID Authentication Portal (Captive Portal) service - CVE-2026-0300
patterns:
- pattern: memcpy($DST,
$SRC,$N)
- pattern-not: memcpy($DST,$SRC,sizeof($DST))
fix: "// Ensure destination buffer size is validated before memcpy\nif ($N <= sizeof($DST)) {\n memcpy($DST,$SRC,
$N);\n}"
metadata:
cwe: "CWE-787"
owasp: "A3: Injection"
technology: palo-alto-panos
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-0300"
- "https://security.paloaltonetworks.com/CVE-2026-0300"🛡️ CodeQL 审计规则: CVE-2026-0300.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2026-0300.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id cpp/out-of-bounds-write/cve-2026-0300
* @name Out-of-bounds write in PAN-OS User-ID Authentication Portal
* @description User-controlled input from network packets reaches a memory write operation without proper bounds checking,
leading to out-of-bounds write in PAN-OS Captive Portal service.
* @problem.severity error
* @tags security
* external/cwe/cwe-787
*/
import cpp
import semmle.code.cpp.dataflow.TaintTracking
/**
* A source of network input that could be attacker-controlled.
*/
class NetworkPacketSource extends DataFlow::Node {NetworkPacketSource() {exists(FunctionCall fc |
fc.getTarget().getName() in ["recv","recvfrom","read","fread"] and
this = fc.getQualifier()
)
}}/**
* An out-of-bounds write sink - detecting array writes without bounds checking.
*/
class OutOfBoundsWriteSink extends DataFlow::Node {OutOfBoundsWriteSink() {exists(ArrayExpr ae |ae.getArrayOffset() = this.asExpr() and
not exists(BoundsCheck bc |bc.checksOffset(ae))
)
}}
/**
* Helper predicate to check if an expression is used to index an array safely.
*/
predicate hasBoundsCheck(Expr idx,ArrayExpr arr) {exists(IfStmt ifs |ifs.getCond().(BinaryLogicalOperation).getAnOperand() = idx.(RelationalOperation) and
ifs.getThen() = arr.getParent()
)
}
/**
* Taint tracking configuration for out-of-bounds write vulnerability.
*/
class OutOfBoundsWriteConfig extends TaintTracking::Configuration {OutOfBoundsWriteConfig() {this = "OutOfBoundsWriteConfig" }override predicate isSource(DataFlow::Node source) {source instanceof NetworkPacketSource
}override predicate isSink(DataFlow::Node sink) {sink instanceof OutOfBoundsWriteSink
}
override predicate isAdditionalTaintStep(DataFlow::Node node1,DataFlow::Node node2) {// Step through pointer arithmetic and type conversions
exists(Cast cast |cast.getExpr() = node1.asExpr() and
node2.asExpr() = cast
) or
exists(PointerArithmetic pa |pa.getBase() = node1.asExpr() and
pa.getResult() = node2.asExpr()
)
}}from OutOfBoundsWriteConfig cfg,
DataFlow::Node source,DataFlow::Node sink
where cfg.hasFlow(source,sink)
select sink,"Out-of-bounds write: attacker-controlled data from network input flows to array write without bounds check.",source,"Network packet input source."🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-10 07:06 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库