Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
THREAT ADVISORY Palo Alto Firewall Zero-Day May 7, 2026
Excerpt
DOWNLOAD PDF Background/Summary On May 6, 2026, Palo Alto Networks disclosed CVE-2026-0300 , a critical buffer overflow vulnerability in the User-ID Authentication Portal (also known as Captive Portal) service of PAN-OS. The flaw allows unauthenticated remote code execution (RCE) with root privileges on affected PA-Series and VM-Series firewalls via specially crafted network packets. Exploitation is limited but confirmed in the wild, primarily targeting instances with the…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 146.70.100.69 | High | Score 58/100 | First seen |
| CVE | CVE-2026-0300 | High | Score 72/100 | First seen |
| SHA256 | e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584 | Medium | Score 53/100 | First seen |
| URL | http://146.70.100.69:8000/php_sess | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…