Unit 42 Details Limited Exploitation of PAN-OS CVE-2026-0300
Summary
Unit 42 reports limited exploitation of PAN-OS CVE-2026-0300, an unauthenticated root-code-execution flaw, by likely state-sponsored cluster CL-STA-1132. Observed activity included shellcode injection, tunneling tools, Active Directory enumeration and log cleanup.
Key points
- Palo Alto Networks disclosed CVE-2026-0300 on May 6, 2026; the buffer overflow in the PAN-OS User-ID Authentication Portal can allow unauthenticated root code execution on PA-Series and VM-Series firewalls.
- Unit 42 says exploitation has been limited and attributes the activity to CL-STA-1132, a cluster it assesses as likely state-sponsored.
- Attackers injected shellcode into an nginx worker process after achieving remote code execution.
- Post-compromise activity included deploying EarthWorm and ReverseSocks5 for tunneling and using firewall service-account credentials for Active Directory enumeration.
- Attackers deleted crash records, core dumps, audit evidence and a SUID privilege-escalation binary.
- Palo Alto recommends restricting the portal to trusted networks or disabling it if unused; eligible customers can enable Threat ID 510019 for protection.
Article Details
- Attack Vectors
- Unauthenticated exploitation of CVE-2026-0300 through specially crafted network packets sent to an exposed PAN-OS User-ID Authentication Portal.
- Shellcode injection into an nginx worker process after successful exploitation.
- Deployment of EarthWorm and ReverseSocks5 for tunneling and proxy access.
- Active Directory enumeration using service-account credentials reportedly obtained from the compromised firewall.
- A SAML flood against a previously targeted device promoted a second device to Active, after which the attackers reportedly achieved RCE on that device.
- Defensive Notes
- Restrict User-ID Authentication Portal access to trusted zones and IP addresses; disable it if it is not required.
- Disable Response Pages on interfaces where untrusted or internet traffic can ingress, while retaining them only on trusted internal interfaces where needed.
- Customers with Advanced Threat Prevention can enable Threat ID 510019; the article says this requires PAN-OS 11.1 or later and Applications and Threats content version 9097-10022.
- Palo Alto Networks recommends following the security advisory. Cortex Xpanse can identify exposed portal instances potentially vulnerable to CVE-2026-0300.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 136[.]0[.]8[.]48 | Listed by Unit 42 among C2/staging and related infrastructure for the activity. |
| IPV4 | 146[.]70[.]100[.]69 | Identified as C2 staging and used to host the EarthWorm download. |
| IPV4 | 149[.]104[.]66[.]84 | Listed by Unit 42 among C2/staging and related infrastructure for the activity. |
| IPV4 | 67[.]206[.]213[.]86 | Listed by Unit 42 among C2/staging and related infrastructure for the activity. |
| SHA256 | e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584 | SHA-256 hash identified by Unit 42 for the EarthWorm binary. |
| URL | hxxp[:]//146[.]70[.]100[.]69:8000/php_sess | EarthWorm download URL hosted on infrastructure Unit 42 identified as C2 staging. |
| URL | hxxps[:]//github[.]com/Acebond/ReverseSocks5/releases/download/v2.2.0/ReverseSocks5-v2.2.0-linux-amd64.tar[.]gz | Specific ReverseSocks5 download URL identified in the article as a tool download used in the activity. |
MITRE ATT&CK
T1055 · Process InjectionAfter exploitation, the attackers injected shellcode into an nginx worker process.T1070.002 · Clear Linux or Mac System LogsThe attackers cleared crash kernel messages and deleted evidence from the audit log.T1070.004 · File DeletionThe attackers deleted crash dumps and other files, including a SUID privilege-escalation binary, to remove evidence.T1078 · Valid AccountsThe attackers used firewall service-account credentials, reportedly obtained from the firewall, during Active Directory enumeration.T1087.002 · Domain AccountThe attackers enumerated Active Directory identities and domains using service-account credentials from the firewall.T1090 · ProxyThe attackers deployed EarthWorm and ReverseSocks5, tools described in the article as providing SOCKS5 proxy or tunnel access.T1190 · Exploit Public-Facing ApplicationThe attackers exploited the exposed PAN-OS User-ID Authentication Portal over network traffic to obtain unauthenticated remote code execution.
CVE
Threat Actors
Vendors
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS Security identify known URLs and domains associated with this activity as malicious.Advanced Threat PreventionCustomers with an Advanced Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 510019 from Applications and Threats content version 9097-10022.Advanced URL FilteringAdvanced URL Filtering and Advanced DNS Security identify known URLs and domains associated with this activity as malicious.Advanced WildFireThe Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of indicators associated with this activity.Cortex XpansePalo Alto Networks Cortex Xpanse can identify exposed instances of the User-ID Authentication Portal potentially vulnerable to CVE-2026-0300.PA-SeriesPalo Alto Networks disclosed CVE-2026-0300, a buffer overflow in PAN-OS User-ID Authentication Portal that can let unauthenticated attackers gain root code execution on PA-Series and VM-Series firewalls.PAN-OSPalo Alto Networks disclosed CVE-2026-0300, a buffer overflow in PAN-OS User-ID Authentication Portal that can let unauthenticated attackers gain root code execution on PA-Series and VM-Series firewalls.User-ID Authentication PortalPalo Alto Networks disclosed CVE-2026-0300, a buffer overflow in PAN-OS User-ID Authentication Portal that can let unauthenticated attackers gain root code execution on PA-Series and VM-Series firewalls.VM-SeriesPalo Alto Networks disclosed CVE-2026-0300, a buffer overflow in PAN-OS User-ID Authentication Portal that can let unauthenticated attackers gain root code execution on PA-Series and VM-Series firewalls.
Tools
EarthwormUnit 42 attributes limited real-world exploitation to CL-STA-1132, which used shellcode injection, EarthWorm, ReverseSocks5, Active Directory enumeration, and log wiping to maintain access.ReverseSocks5Unit 42 attributes limited real-world exploitation to CL-STA-1132, which used shellcode injection, EarthWorm, ReverseSocks5, Active Directory enumeration, and log wiping to maintain access.