exposedZones.push(zone); } });

return {
  device: node.hostname,
  portalEnabled: exposedZones.length > 0,
  exposedInterfaces: exposedZones,
  riskLevel: exposedZones.length > 0 ? 'CRITICAL' : 'LOW'
};

} catch (error) { console.error(API query failed for ${node.hostname}:, error); return { device: node.hostname, portalEnabled: false, exposedInterfaces: [], riskLevel: 'LOW' }; } }

export { auditCaptivePortal, FirewallNode, PortalExposure };

**Architecture Rationale:** 
- Direct XML API queries bypass UI rendering latency and provide machine-readable configuration state.
- Regex-based zone matching (`untrusted|external|wan`) aligns with standard Palo Alto zone naming conventions while remaining adaptable to custom deployments.
- Timeout and validation handling prevent pipeline stalls during bulk audits.

### Phase 2: Structural Containment
If patch deployment is delayed, modify the interface management profile to strip response page bindings from untrusted zones. This removes the HTTP listener without disabling the underlying User-ID service.

### Phase 3: Patch Deployment Strategy
PAN-OS hotfixes require explicit suffix validation. Standard maintenance branches (e.g., `11.2.10`) do not include the CVE-2026-0300 fix until the Wave 2 maintenance window. Verify build strings explicitly:
- `12.1.4-h5` or `12.1.7`
- `11.2.4-h17`, `11.2.7-h13`, `11.2.10-h6`, `11.2.12`
- `11.1.4-h33`, `11.1.6-h32`, `11.1.7-h6`, `11.1.10-h25`, `11.1.13-h5`, `11.1.15`
- `10.2.7-h34`, `10.2.10-h36`, `10.2.13-h21`, `10.2.16-h7`, `10.2.18-h6`

Deploy hotfixes during maintenance windows. Validate post-upgrade by re-running the exposure audit. Confirm that ports 6081/6082 no longer respond to untrusted ingress.

### Phase 4: Post-Exploitation Verification
Successful exploitation triggers immediate log sanitization. The attacker's shellcode targets the nginx worker, clears kernel crash messages, removes core dumps, and purges authentication audit trails. Implement out-of-band syslog forwarding to a hardened SIEM before containment. Correlate missing log sequences with network flow data to identify lateral movement.

## Pitfall Guide

### 1. Assuming Standard Maintenance Releases Contain the Hotfix
**Explanation:** Palo Alto delivers critical fixes as suffixed hotfix builds. Standard maintenance versions (e.g., `11.2.10`) lack the memory corruption patch until the Wave 2 cycle.
**Fix:** Explicitly verify the `-h` suffix in the build string. Do not rely on version numbers alone.

### 2. Blocking Ports 6081/6082 Globally via Security Policy
**Explanation:** Creating a deny rule for these ports blocks exploitation but also breaks legitimate captive portal workflows. It does not remove the underlying service listener, leaving the binary vulnerable to alternative delivery vectors.
**Fix:** Use interface management profiles to disable response pages on untrusted zones. This removes the HTTP binding at the network profile layer.

### 3. Deploying Threat ID 510019 on PAN-OS 10.2
**Explanation:** The signature relies on decoder enhancements introduced in PAN-OS 11.1. Legacy branches cannot parse the required HTTP inspection rules, rendering the signature inert.
**Fix:** PAN-OS 10.2 environments must rely on structural mitigations (Options A, B, or C) until branch upgrade is feasible.

### 4. Ignoring Log Tampering Indicators
**Explanation:** The documented CL-STA-1132 campaign immediately deletes nginx crash entries and core dumps post-exploitation. Teams monitoring only for alert generation miss the absence of expected system logs.
**Fix:** Baseline normal log volume and implement anomaly detection for sudden drops in `syslog` or `system` log streams.

### 5. Applying Mitigations to Non-Affected Platforms
**Explanation:** Prisma Access, Cloud NGFW, and Panorama do not run the vulnerable User-ID Authentication Portal service. Applying emergency changes to these platforms introduces configuration drift without reducing risk.
**Fix:** Scope all remediation efforts exclusively to PA-Series and VM-Series firewalls running PAN-OS.

### 6. Delaying Patching Until Wave 2 Without Interim Controls
**Explanation:** The gap between public PoC release (May 6) and Wave 2 maintenance (~May 28) provides attackers a 22-day window. Relying solely on future patches ignores active exploitation.
**Fix:** Implement structural containment immediately. Treat Wave 2 as a secondary validation step, not a primary control.

### 7. Overlooking AD Service Account Compromise Post-RCE
**Explanation:** The firewall often stores directory service credentials for User-ID mapping. Root access allows extraction of these tokens, enabling domain enumeration and lateral movement.
**Fix:** Rotate all service accounts bound to the firewall immediately after containment. Monitor for anomalous Kerberos ticket requests originating from firewall IP ranges.

## Production Bundle

### Action Checklist
- [ ] Inventory all PA-Series and VM-Series devices running PAN-OS 10.2 through 12.1
- [ ] Execute automated exposure audit using XML API to identify untrusted zone bindings
- [ ] Disable response pages on all interface management profiles attached to untrusted/external zones
- [ ] Verify hotfix suffix strings match official remediation branches before deployment
- [ ] Enable Threat ID 510019 (content version 9097-10022) on PAN-OS 11.1+ environments
- [ ] Configure out-of-band syslog forwarding to preserve log integrity during incident response
- [ ] Rotate all Active Directory service accounts bound to compromised or exposed firewalls
- [ ] Validate post-patch state by confirming ports 6081/6082 are unreachable from untrusted ingress

### Decision Matrix

| Scenario | Recommended Approach | Why | Cost Impact |
|----------|---------------------|-----|-------------|
| Guest/BYOD identity mapping required | Zone Restriction + Response Page Disable | Preserves internal User-ID workflows while eliminating external attack surface | Low (configuration only) |
| Strict compliance / zero-trust mandate | Full Portal Disable | Mathematically eliminates the vulnerable service; aligns with least-privilege architecture | Medium (requires alternative identity resolution) |
| Legacy PAN-OS 10.2 branch | Structural Mitigation + Branch Upgrade Plan | Signature detection unavailable; hotfixes require suffix validation; upgrade reduces long-term risk | High (upgrade labor + testing) |
| High-throughput core firewall | Threat Signature 510019 + Zone Restriction | Balances detection capability with minimal performance overhead; avoids service disruption | Low (content update + policy adjustment) |

### Configuration Template

The following PAN-OS CLI snippet demonstrates structural containment by modifying interface management profiles. This template disables response pages on untrusted zones while preserving internal functionality.

```text
configure
# Step 1: Identify existing interface management profiles
show network profiles interface-management-profile

# Step 2: Modify untrusted-facing profile
edit network profiles interface-management-profile "UNTRUSTED-MGMT-PROFILE"
set response-pages no
commit

# Step 3: Verify binding removal
show network profiles interface-management-profile "UNTRUSTED-MGMT-PROFILE"

# Step 4: (Optional) Restrict portal access to trusted zones only
set deviceconfig system service "user-id" enable yes
set deviceconfig system service "user-id" trusted-sources "10.0.0.0/8"
set deviceconfig system service "user-id" trusted-sources "172.16.0.0/12"
set deviceconfig system service "user-id" trusted-sources "192.168.0.0/16"
commit

Implementation Notes:

• Replace "UNTRUSTED-MGMT-PROFILE" with your actual profile name.
• The trusted-sources directive limits User-ID queries to RFC1918 ranges, preventing external enumeration.
• Commit operations should be scheduled during maintenance windows to avoid transient policy evaluation delays.

Quick Start Guide

1. Run Exposure Scan: Deploy the TypeScript audit utility against your firewall inventory. Export results to CSV for prioritization.
2. Apply Structural Control: Execute the configuration template on all devices flagged as CRITICAL. Verify response page bindings are removed from untrusted zones.
3. Enable Detection Layer: Update threat prevention content to version 9097-10022. Activate Threat ID 510019 in your security policy rulebase.
4. Validate & Monitor: Confirm ports 6081/6082 are unreachable from external interfaces. Enable syslog forwarding to your SIEM and baseline log volume for anomaly detection.
5. Schedule Patching: Queue the appropriate hotfix build for your PAN-OS branch. Validate suffix strings before deployment. Re-run the exposure audit post-upgrade to confirm remediation.