Actively Exploited Zero-Day (CVE-2026-0300) in PAN-OS Allows RCE on Palo Alto Networks Firewalls

Executive Summary

Palo Alto Networks has confirmed a critical-severity zero-day vulnerability, CVE-2026-0300, in its PAN-OS software is being actively exploited in the wild. The flaw, a buffer overflow in the firewall's Captive Portal (User-ID Authentication Portal), allows an unauthenticated remote attacker to execute arbitrary code with root privileges. The vulnerability affects internet-facing PA-Series and VM-Series firewalls where the Captive Portal is enabled. Due to evidence of limited but active exploitation, likely by state-sponsored actors, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies apply mitigations by May 9, 2026. Patches are in development, and customers are urged to apply workarounds immediately.

Vulnerability Details

CVE-2026-0300 is a buffer overflow vulnerability. It can be triggered by sending specially crafted packets to the User-ID Authentication Portal, commonly known as the Captive Portal, which is used to identify users on the network. A successful exploit does not require any authentication and results in remote code execution (RCE) with the highest possible privileges (root) on the firewall appliance itself. Gaining control of a perimeter firewall is a catastrophic security failure, as it allows an attacker to monitor, modify, and redirect all network traffic, disable security policies, and pivot into the internal network.

Affected Systems

The vulnerability affects the following Palo Alto Networks products running PAN-OS with the Captive Portal feature enabled and exposed to the internet or untrusted networks:

• PA-Series (Hardware Firewalls)
• VM-Series (Virtual Firewalls)

Palo Alto Networks has confirmed that its Cloud NGFW, Panorama appliances, and Prisma Access products are not affected.

Exploitation Status

The vulnerability is under active, albeit limited, exploitation. This pattern of use typically suggests that a sophisticated threat actor, such as a nation-state group, is using the exploit for high-value targeted attacks rather than widespread, indiscriminate campaigns. CISA's inclusion of CVE-2026-0300 in the KEV catalog confirms the active threat and elevates the urgency for all organizations to take action.

Impact Assessment

The impact of exploiting CVE-2026-0300 is critical. An attacker with root access on a perimeter firewall effectively owns the network boundary. They can:

• Intercept and decrypt traffic.
• Bypass all firewall security policies.
• Gain a persistent foothold on a critical piece of network infrastructure.
• Launch attacks against the internal network from a trusted position.
• Install malware or backdoors on the firewall itself. This level of access could facilitate espionage, data exfiltration, or the deployment of ransomware across the entire organization.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Vulnerability Scanners: Use vulnerability management tools to scan for exposed Palo Alto Networks firewalls and check for the specific PAN-OS versions affected.
• Log Analysis: Ingest firewall traffic and system logs into a SIEM. Create rules to alert on anomalous traffic to the Captive Portal URL or any outbound connections originating from the firewall's management plane. D3FEND's D3-NTA - Network Traffic Analysis is crucial for spotting exploit attempts and post-compromise C2 traffic.
• Threat Hunting: Proactively hunt for the observables listed above. Check for any unexplained configuration changes, new local user accounts on the firewall, or unusual files on the filesystem.

Remediation Steps

1. Apply Mitigations Immediately: Do not wait for the patch. Palo Alto Networks strongly advises customers to restrict access to the User-ID Authentication Portal. This can be done by applying an access control policy to the portal interface that only allows access from trusted, internal IP addresses. This breaks the remote attack chain.
2. Disable Captive Portal if Unused: If the Captive Portal feature is not essential for business operations, disable it entirely to remove the attack surface.
3. Apply Patches: Monitor Palo Alto Networks' security advisories and apply the forthcoming patches for CVE-2026-0300 on an emergency basis as soon as they are released (expected May 13 and May 28). This is the only permanent fix (M1051 - Update Software).
4. Threat Hunt: After applying mitigations, hunt for any signs of prior compromise using the detection methods described above.