Suspected state-backed hackers are breaking into Palo Alto Networks firewalls by abusing a newly disclosed flaw in the device login page, taking full control without any password. Palo Alto Networks disclosed CVE-2026-0300 on May 6, 2026, a buffer overflow (a coding bug where attacker data overruns a memory buffer and lets them run their own code) in the User-ID Authentication Portal, often called the Captive Portal, of PAN-OS. It lets an unauthenticated attacker run arbitrary code with root (full administrator) privileges on PA-Series and VM-Series firewalls. Unit 42's Justin Moore reports limited real-world exploitation tied to a new activity cluster the team tracks as CL-STA-1132, which it assesses as likely state-sponsored.
What's affected
The flaw hits on-premises PAN-OS firewalls where the User-ID Authentication Portal can be reached from untrusted networks. Cloud-based products are not affected: Prisma Access, Cloud NGFW, and Panorama appliances are safe. Palo Alto Networks warns that exposing the portal to the public internet sharply raises the risk, and that limiting it to internal addresses cuts the attack surface. Cortex Xpanse can find exposed Captive Portal instances, and customers running Advanced Threat Prevention can block attack traffic using Threat ID 510019.
How the attack works
According to Unit 42, failed probes against one firewall started on April 9, 2026. About a week later the attacker got in, achieving remote code execution and injecting shellcode (a small piece of attacker code) into an nginx web server worker process. Right after the break-in, the operators wiped kernel crash messages and deleted nginx crash logs and core dumps to make forensic recovery harder. Four days later they staged more tools as root and searched Active Directory using credentials stolen from the firewall, going after the domain root and DomainDnsZones containers. They then erased ptrace injection traces from the audit log and removed a privilege-escalation binary.
On April 29, 2026, the same operators hit the original device with a SAML flood, forcing its high-availability backup partner to take over the Active role and the same internet-facing traffic. They then broke into that second firewall and deployed two freely available tunneling tools: EarthWorm, an open-source SOCKS5 and port-forwarding utility written in C, and ReverseSocks5, a reverse SOCKS5 tunnel hosted on GitHub. EarthWorm has shown up before in activity linked to CL-STA-0046, Volt Typhoon, UAT-8337, and APT41, but Unit 42 has not directly tied CL-STA-1132 to any of those groups. The reliance only on open-source tools, plus brief hands-on-keyboard sessions and careful log cleanup, looks like a deliberate effort to stay under detection thresholds. Salient indicators of compromise include the EarthWorm staging server 146[.]70[.]100[.]69 (download URL hxxp://146[.]70[.]100[.]69:8000/php_sess), related IPs 67[.]206[.]213[.]86, 136[.]0[.]8[.]48, and 149[.]104[.]66[.]84, an EarthWorm SHA-256 of e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584, and on-host file paths such as /var/tmp/linuxap, /var/tmp/linuxda, /var/tmp/linuxupdate, /tmp/.c, /tmp/R5, and /var/R5.
What you should do
This is the kind of espionage-grade campaign against edge devices that fits a broader nation-state shift toward targeting firewalls, VPN gateways, and routers over the past five years. Patch per the Palo Alto Networks advisory, restrict User-ID Authentication Portal exposure, disable Response Pages on untrusted-zone L3 interfaces, and hunt for the EarthWorm and ReverseSocks5 artifacts listed above.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.