Breaking: Palo Alto Networks PAN-OS Zero-Day CVE-2026-0300 Exploited in the Wild
Cybersecurity researchers at Unit 42 have confirmed active exploitation of a critical zero-day vulnerability in Palo Alto Networks PAN-OS software. Tracked as CVE-2026-0300, this buffer overflow flaw grants unauthenticated attackers remote code execution capabilities, posing an immediate threat to organizations worldwide.
The vulnerability resides in the User-ID Authentication Portal within PAN-OS 10.x and 11.x versions. Attackers can send specially crafted packets to crash the system or execute arbitrary commands without any credentials.
Expert Alert: 'Patch Immediately'
"This is a severe issue — we are seeing active exploitation attempts targeting unpatched firewalls," said a Unit 42 senior analyst. "Organizations must treat this as a top priority patching event. Delay could lead to full network compromise."
Unit 42 urges administrators to understand the attack vector and apply mitigations without delay.
Background: The PAN-OS Captive Portal Flaw
CVE-2026-0300 is a stack-based buffer overflow in the captive portal module of PAN-OS. The captive portal handles authentication for guest users, but insufficient bounds checking allows attackers to overflow a buffer with malicious data.
This vulnerability is particularly dangerous because it requires no prior access — the exploit works from the network boundary. Palo Alto Networks has released security advisory PAN-SA-2024-0002 with patched versions.
What This Means for Organizations
Successful exploitation gives attackers complete control over the firewall, enabling lateral movement, data exfiltration, and persistent backdoors. "We have evidence of threat actors using this to drop webshells and pivot into internal networks," the Unit 42 expert added.
Any organization using PAN-OS with captive portal enabled is at risk. The vulnerability impacts both hardware firewalls and virtual deployments. Immediate patching to PAN-OS 10.2.9-h1, 11.0.4-h2, or later is critical.
Recommended Actions
- Apply Security Updates: Upgrade to fixed PAN-OS versions listed in the advisory.
- Monitor for Indicators: Check firewall logs for unusual captive portal traffic or crash events.
- Restrict Access: Temporarily disable captive portal if patching is delayed.
Unit 42 has published detailed technical analysis and IOCs. This is an evolving situation; organizations should monitor Unit 42 blogs for updates.
This is a breaking news story. We will update as more information becomes available.