Detect Palo Alto Networks PAN-OS Out-of-bounds Write (CVE-2026-0300) in Elastic Security
Detects exploitation attempts targeting CVE-2026-0300, an out-of-bounds write vulnerability (CWE-787) in Palo Alto Networks PAN-OS. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to execute arbitrary code, crash the device, or escalate privileges on affected PAN-OS appliances. Detection focuses on anomalous management plane activity, unexpected process crashes, memory corruption indicators, and suspicious inbound traffic patterns targeting PAN-OS management interfaces.
MITRE ATT&CK
- Tactic
- Initial Access Execution Impact
Elastic Detection Query
sequence by host.name with maxspan=10m
[network where
destination.port in (443, 4443, 8443) and
network.direction == "inbound" and
event.dataset == "panw.panos"
] with runs=5
[process where
event.dataset == "panw.panos" and
(
process.name in ("sslmgrd", "pan_gp", "configd", "authd", "pan_comm") and
event.action in ("end", "crash", "terminate") and
process.exit_code != 0
)
]Elastic EQL sequence detection for CVE-2026-0300. Correlates a burst of inbound connections to PAN-OS management ports followed by abnormal process termination of core PAN-OS daemons, indicative of memory corruption exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Planned PAN-OS content or software updates that restart management daemons
- Network load balancer health checks generating bursts of connections to management ports
- Legitimate high-frequency API polling from SIEM or SOAR integrations
- Process monitoring tools that track daemon lifecycle and generate false termination events
Other platforms for CVE-2026-0300
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate malformed HTTPS payload to PAN-OS management interface
Expected signal: PAN-OS threat logs should record an anomalous inbound connection; syslog may show a connection handling error or rate limit trigger on the management interface.
- Test 2Trigger PAN-OS management daemon crash simulation via process kill
Expected signal: PAN-OS system logs will record a process crash event for sslmgrd with signal 11 (SIGSEGV); watchdog restart will generate a subsequent SYSTEM log entry. Syslog forwarding will push these to the SIEM.
- Test 3Enumerate PAN-OS management interface exposure and version fingerprinting
Expected signal: PAN-OS management logs will record the inbound HTTPS requests from the test source IP. If threat prevention is enabled, reconnaissance-pattern requests may trigger a threat log entry.
Response Playbook
Triage
- Immediately identify all PAN-OS devices in your environment and cross-reference against affected versions published in the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0300.
- Review PAN-OS system logs (Monitor > Logs > System) for crash events, process restarts, or out-of-bounds error messages on any PAN-OS appliances, focusing on the sslmgrd, pan_gp, configd, and authd processes.
- Examine inbound connection logs to PAN-OS management interfaces (TCP 443, 4443, 8443) for anomalous source IPs, unusually high request volumes, or access patterns inconsistent with known administrators and automation systems.
- Check CISA KEV catalog entry and Palo Alto Networks advisory for indicators of compromise (IOCs) specific to observed exploitation campaigns and compare against your firewall and proxy logs.
- Determine if management interface access is restricted to trusted IP ranges via PAN-OS admin access restrictions — unrestricted management exposure significantly elevates exploitation risk.
Containment
- If exploitation is confirmed or strongly suspected, immediately restrict PAN-OS management interface access to a dedicated, isolated management network or known-good administrator IP allowlist using PAN-OS Management Interface Access settings.
- Apply the vendor patch or workaround from Palo Alto Networks (https://security.paloaltonetworks.com/CVE-2026-0300) on all affected PAN-OS appliances. If patching is not immediately possible, disable unnecessary management services and enforce MFA on all admin accounts.
- Isolate any PAN-OS appliance showing active crash or memory corruption indicators from the production network pending forensic review and patching — route traffic through a backup firewall or enable HA failover to a patched peer.
Evidence Collection
- Export PAN-OS tech support files (Device > Support > Export Tech Support File) from affected appliances — these capture process crash dumps, system logs, configuration, and routing state critical for forensic analysis.
- Capture network packet captures (pcaps) of inbound management interface traffic from the period surrounding the first crash event using the PAN-OS packet capture feature (Monitor > Packet Capture) or an upstream tap, preserving evidence of exploit payloads.
- Preserve PAN-OS system log exports (Monitor > Logs > System, exported to CSV or syslog) covering at minimum 72 hours prior to the first detected anomaly.
Escalation Criteria
- !Escalate immediately to incident response if a PAN-OS process crash is correlated with a subsequent unauthorized configuration change, new admin account creation, or unexpected outbound connection from the firewall management plane — these indicate successful exploitation and potential implant deployment.
- !Escalate if the affected PAN-OS appliance is a perimeter firewall protecting critical infrastructure, a GlobalProtect VPN gateway, or a Panorama management server — the blast radius of a compromised perimeter device is organization-wide.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PAN-OS tech support bundle (/var/log/pan/ directories) containing process crash dumps, system journal entries, and management plane audit logs. - >
Core dump files on the PAN-OS filesystem (typically under /tmp or /var/cores) generated by out-of-bounds write crashes in management daemons. - >
PAN-OS configuration audit log (config log) showing any changes made during or after the exploitation window, accessible via Monitor > Logs > Configuration. - >
Network pcap evidence of malformed or oversized payloads delivered to PAN-OS management HTTPS endpoints that may have triggered the out-of-bounds write condition.
Tuning Guidance
Start by suppressing known management automation IPs (SIEM collectors, SOAR platforms, monitoring agents) from the inbound traffic volume detections to reduce false positive volume. For crash-based detections, establish a baseline of expected PAN-OS process restart frequency during content update windows and exclude those scheduled maintenance periods. Tune the event_count thresholds in Splunk and Sumo Logic queries upward (from 2-3 to 5+) if your environment has chatty PAN-OS logging. For the CrowdStrike and Elastic detections, confirm the sensor is deployed on the PAN-OS VM host or an adjacent syslog collector rather than an unrelated endpoint to avoid false matches. If direct CVE string matching (cve-2026-0300 in payload) produces results, treat those as high-confidence and escalate immediately regardless of other threshold tuning.
Hunting Queries
Hunt for PAN-OS appliances exhibiting repeated process crash or restart events over the past 7 days — elevated crash frequency on management daemons may indicate repeated exploitation attempts or a partially successful exploit leaving the device in an unstable state.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor == "Palo Alto Networks"
| where Activity has_any ("crash", "restart", "core", "segfault", "abort")
| summarize CrashCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, Activity
| where CrashCount > 0
| order by CrashCount descindex=firewall sourcetype=pan:system earliest=-7d
| search subtype=general (description="*crash*" OR description="*restart*" OR description="*core*" OR description="*segfault*")
| stats count AS crash_events, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(description) AS crash_descriptions BY host
| sort -crash_eventsHunt for abnormally high inbound request volumes to PAN-OS management ports — volumetric anomalies may indicate automated exploit scanning or repeated exploitation attempts probing for CVE-2026-0300.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor == "Palo Alto Networks"
| where DestinationPort in (443, 4443, 8443)
| where Direction == "Inbound"
| summarize RequestCount = count(), UniqueIPs = dcount(SourceIP) by Computer, DestinationIP, bin(TimeGenerated, 1h)
| where RequestCount > 1000 or UniqueIPs > 20
| order by RequestCount descindex=network sourcetype=pan:traffic dest_port IN (443, 4443, 8443) direction=inbound earliest=-7d
| timechart span=1h count BY dest_ip
| where count > 1000Atomic Red Team Tests
Sends an oversized, malformed HTTP POST body to the PAN-OS HTTPS management port to simulate the class of input that triggers out-of-bounds write conditions. This is a safe simulation that exercises detection logic without exploiting a real vulnerability.
Command
python3 -c "
import socket, ssl, time
host = '${TARGET_PANOS_IP}'
port = 443
payload = 'POST /esp/cms_ids.esp HTTP/1.1\r\nHost: ' + host + '\r\nContent-Length: 65535\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n' + 'A' * 65535
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
with socket.create_connection((host, port), timeout=10) as sock:
with ctx.wrap_socket(sock, server_hostname=host) as ssock:
ssock.sendall(payload.encode())
time.sleep(2)
response = ssock.recv(4096)
print(response.decode(errors='replace'))
"Cleanup
No persistent changes — single TCP connection closed after response. Review PAN-OS system logs and clear any triggered threat log entries in lab environment.Expected Telemetry
PAN-OS threat logs should record an anomalous inbound connection; syslog may show a connection handling error or rate limit trigger on the management interface.
Expected Detection
KQL and SPL detections monitoring inbound management port traffic volumes should fire; if PAN-OS threat detection is enabled, a CommonSecurityLog entry with threat category should appear.
On a lab PAN-OS VM, forcibly terminates the sslmgrd process with SIGSEGV to simulate the crash telemetry expected from a successful out-of-bounds write exploitation, validating crash-based detections.
Command
# Run on PAN-OS VM console or via SSH as admin
# Step 1: Identify sslmgrd PID
sslmgrd_pid=$(pgrep sslmgrd)
echo "sslmgrd PID: $sslmgrd_pid"
# Step 2: Send SIGSEGV to simulate memory corruption crash
kill -SIGSEGV $sslmgrd_pid
# Step 3: Wait for PAN-OS watchdog to restart the process
sleep 10
pgrep sslmgrd && echo "Process restarted by watchdog" || echo "Process did not restart"Cleanup
PAN-OS watchdog should automatically restart sslmgrd. If not, restart the management daemon via: debug software restart process sslmgrd. Restore normal PAN-OS operation and clear lab system logs.Expected Telemetry
PAN-OS system logs will record a process crash event for sslmgrd with signal 11 (SIGSEGV); watchdog restart will generate a subsequent SYSTEM log entry. Syslog forwarding will push these to the SIEM.
Expected Detection
Crash-based detections in KQL (Syslog table), SPL (pan:system sourcetype), and Chronicle YARA-L should trigger on the SIGSEGV process termination event for sslmgrd.
Uses curl to fingerprint an exposed PAN-OS management interface version banner and enumerate accessible endpoints, simulating reconnaissance that precedes CVE-2026-0300 exploitation targeting.
Command
TARGET="${TARGET_PANOS_IP}"
echo "[*] Fingerprinting PAN-OS management interface at $TARGET"
# Version banner via login page
curl -sk --max-time 10 "https://$TARGET/php/login.php" -I | grep -i 'server\|x-pan\|set-cookie\|content-type'
# Check GlobalProtect portal exposure
curl -sk --max-time 10 "https://$TARGET/global-protect/login.esp" -o /dev/null -w "GlobalProtect portal HTTP status: %{http_code}\n"
# Check SSL VPN endpoint
curl -sk --max-time 10 "https://$TARGET/ssl-vpn/login.esp" -o /dev/null -w "SSL-VPN endpoint HTTP status: %{http_code}\n"
# Check management API availability
curl -sk --max-time 10 "https://$TARGET/api/?type=version" | grep -o '<result>.*</result>' | head -5
echo "[*] Enumeration complete"Cleanup
No changes made to target system. Review source IP in PAN-OS management logs and remove from any block lists if this was an authorized test. Document test execution in change management system.Expected Telemetry
PAN-OS management logs will record the inbound HTTPS requests from the test source IP. If threat prevention is enabled, reconnaissance-pattern requests may trigger a threat log entry.
Expected Detection
The inbound management traffic detections should log the test connections. If testing from an IP not in the admin allowlist, PAN-OS may generate an authentication failure or access violation log entry visible in CommonSecurityLog and pan:system.