Seven PoCs, four defenders, two placeholders, one missing patch

CISA put CVE-2026-0300 on the Known Exploited Vulnerabilities catalog with a federal patch deadline of 2026-05-09. That deadline was yesterday. Palo Alto Networks ships the patch on 2026-05-13. Four days, no fix, federal agencies in formal violation, and every PAN-OS administrator running the User-ID Authentication Portal is now sitting in front of a config tree wondering whether show config running | match authentication-portal returns anything useful.

It doesn't. The CVE record uses the modern feature name. The PAN-OS XML schema element is still captive-portal. The CLI knobs and the documentation URL paths still use the legacy vocabulary. TailwindRG's audit script flags this in plain text: "The CVE record uses the modern feature name 'User-ID Authentication Portal.' The PAN-OS XML schema, CLI knobs, and documentation URL paths still use the legacy captive-portal vocabulary." Anyone grepping for the modern name in their own configs sees nothing and moves on. The vulnerability lives in the thing that isn't called what the advisory calls it.

This is disclosure after exploitation in its plainest shape. The public did not learn about CVE-2026-0300 from a coordinated advisory with a patch attached; it learned because CISA saw the bug being used and put a clock on it. Now look at what the public ecosystem produced in the window that clock opened.

The seven artifacts

There are seven public PoCs. Four are defensive. Two are buffer-overflow stubs with placeholder return addresses. One is a Mastodon link.

TailwindRG/cve-2026-0300-audit is a Panorama-driven, read-only fleet audit. It sends the API key via the X-PAN-KEY header instead of the URL. It caps response bodies at 50 MB. It backs off retries on a fixed schedule. It walks the captive-portal XML element across every vsys on every connected device, classifies each into INFO_NOT_CONFIGURED, INFO_DISABLED, REVIEW_POLICY_NO_BINDINGS, EXPOSED_LIKELY, or REVIEW_POLICY, and writes CSV. The README acknowledges that the PAN-OS XML API admin-role tab is a binary Enable/Disable with no read-only grant, and tells you to issue the key from a low-privilege account anyway.

mr-r3b00t/CVE-2026-0300 is a honeypot. It listens on 6080 (HTTP), 6081 (HTTPS with a default cert), and 6082 (HTTPS with a redirect-mode cert). It generates PAN-lookalike self-signed certificates with O=Palo Alto Networks and a 12-digit serial as the CN. It captures JA3 fingerprints. It truncates request bodies at 64 KiB but logs the truncation flag so the buffer-overflow evidence survives. It returns a static 403 to everything. It ships with a systemd installer, CAP_NET_BIND_SERVICE, and a hardened service unit.

shizuku198411/CVE-2026-0300 is a non-destructive exposure survey. HEAD, GET, and OPTIONS only, against /, /php/login.php, /php/uid.php, /php/uidlogin.php, /sslmgr, and /global-protect/login.esp. It embeds a PANOS_FIXED_THRESHOLDS table with the actual PAN-published fixed versions: 12.1.4-h5, 12.1.7, 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6. Whoever wrote this read the advisory line by line.

0xBlackash/CVE-2026-0300 is a one-shot GET checker. It reports VULNERABLE / EXPOSED if any portal path returns 200, 301, or 302. The README notes patches are expected May 13, 2026.

Four defensive artifacts, four authors who read the same advisory and concluded the right move was to help administrators find the thing, harden the perimeter, classify the exposure, and bait whoever shows up to swing at it. Every one of the four is a study in how the detector is the target: TailwindRG's audit walks the live config from a Panorama key it admits PAN-OS cannot scope down; mr-r3b00t's honeypot impersonates the vulnerable portal down to the certificate subject and the JA3 capture; shizuku's survey probes the same /php/login.php path the exploit stubs POST to. The defensive tool and the attack surface are the same box, reached the same way.

Then there are two PoCs labelled "exploit."

The two stubs

bannned-bit/CVE-2026-0300-PANOS/Poc.py:

padding   = b"A" * args.offset                    # default 2048
ret_addr  = struct.pack("<Q", int(args.ret, 16))  # default "0x414141414141"
shellcode = b"\x90" * 32 + b"\xcc" * 32           # NOPs + INT3 breakpoints
payload   = padding + ret_addr + shellcode

The default return address 0x414141414141 is the ASCII bytes "AAAAAA" packed little-endian as an address, the value a debugger shows you when uncontrolled overflow data has already smashed your saved RIP. The "shellcode" is thirty-two NOPs followed by thirty-two INT3 instructions. INT3 is the x86 software-breakpoint opcode. It is not a payload. It is what an exploit dev parks in the buffer while still trying to work out where execution lands. The class name in the file is CVE202603OOExploit, with a capital O where a zero belongs. The bundled VULNERABILITY.md fabricates an affected-version table claiming PAN-OS 8.0 through 10.1 are vulnerable and 11.0 and later are patched, which is the inverse of the real advisory.

p3Nt3st3r-sTAr/CVE-2026-0300-POC/research_poc.py:

padding         = b"A" * args.offset                    # default 2048
return_address  = struct.pack("<Q", int(args.ret, 16))  # default "0xdeadbeef"
payload         = padding + return_address + (b"\x90" * 128) + shellcode

0xdeadbeef is the canonical buffer-overflow-tutorial placeholder address. The shellcode block in this one is real, a properly assembled msfvenom linux/x64/shell_reverse_tcp payload patched with the operator's LHOST and LPORT, but it never runs, because the return address is 0xdeadbeef and nothing in the file pretends otherwise. The banner prints the author's Telegram handle twice in a row because a placeholder line was left inside the f-string. The ANSI-color spinner animation works perfectly.

Both stubs default to offset=2048. Two thousand forty-eight bytes is the offset value carried by the Python buffer-overflow walkthroughs that come up first when you search for struct.pack ret address. Neither author measured the buffer in the actual PAN-OS binary. Neither author knows where the captive-portal handler leaves the saved return pointer when it ingests a too-large POST body. The KEV listing means somebody does. That somebody is not in either repository.

Who is silent, and why

Palo Alto Networks knows the exact buffer, the exact offset, the instruction-pointer overwrite path, and the mitigations present on each affected train. The advisory contains none of it. The patch ships four days after the federal deadline.

CISA knows the in-the-wild exploitation evidence, because that is the entry criterion for the KEV catalog. The KEV listing contains no indicators, no attribution, no technical detail.

The actor or actors who triggered the listing know how to land RIP on PAN-OS captive-portal traffic with no patch to diff and no source to read. Their tooling is not on GitHub. A KEV-listed primitive against unpatched edge appliances is not a capability anyone burns for clout. Whoever holds it is using it. The seven public PoCs are what fills the silence.

The role frame

A PAN-OS administrator at a federal agency reads the KEV listing on May 8, sees the May 9 deadline, and goes hunting through the configuration tree for the User-ID Authentication Portal. The grep returns nothing because the schema element is captive-portal. They pull TailwindRG's audit script, run it from a Panorama API key, and get back a CSV that flags the vsys with portal config and live policy bindings. They restrict the portal's source IPs to the trusted internal zone the way the mitigation guidance says to. They file a deadline-exception ticket with their assessment authority. Then they wait four days for the patch.

That is the best case the public ecosystem supports. Everything else, the stubs, the placeholder return addresses, the inverted affected-version table, the banner with the duplicated handle, is noise the administrator triages past while the deadline is already in the rearview.

Palo Alto Networks shipped the buffer overflow. CISA caught the exploitation. The patch is four days late. The administrator is the one holding the gap.