Critical PAN-OS Zero-Day Under Active Exploitation: Urgent Patch Required
Breaking: Palo Alto Networks PAN-OS Zero-Day CVE-2026-0300 Exploited in the Wild
Cybersecurity researchers at Unit 42 have confirmed active exploitation of a critical zero-day vulnerability in Palo Alto Networks PAN-OS software. Tracked as CVE-2026-0300, this buffer overflow flaw grants unauthenticated attackers remote code execution capabilities, posing an immediate threat to organizations worldwide.
The vulnerability resides in the User-ID Authentication Portal within PAN-OS 10.x and 11.x versions. Attackers can send specially crafted packets to crash the system or execute arbitrary commands without any credentials.
Expert Alert: 'Patch Immediately'
"This is a severe issue — we are seeing active exploitation attempts targeting unpatched firewalls," said a Unit 42 senior analyst. "Organizations must treat this as a top priority patching event. Delay could lead to full network compromise."
Unit 42 urges administrators to understand the attack vector and apply mitigations without delay.
Background: The PAN-OS Captive Portal Flaw
CVE-2026-0300 is a stack-based buffer overflow in the captive portal module of PAN-OS. The captive portal handles authentication for guest users, but insufficient bounds checking allows attackers to overflow a buffer with malicious data.
This vulnerability is particularly dangerous because it requires no prior access — the exploit works from the network boundary. Palo Alto Networks has released security advisory PAN-SA-2024-0002 with patched versions.
What This Means for Organizations
Successful exploitation gives attackers complete control over the firewall, enabling lateral movement, data exfiltration, and persistent backdoors. "We have evidence of threat actors using this to drop webshells and pivot into internal networks," the Unit 42 expert added.
Any organization using PAN-OS with captive portal enabled is at risk. The vulnerability impacts both hardware firewalls and virtual deployments. Immediate patching to PAN-OS 10.2.9-h1, 11.0.4-h2, or later is critical.
Recommended Actions
- Apply Security Updates: Upgrade to fixed PAN-OS versions listed in the advisory.
- Monitor for Indicators: Check firewall logs for unusual captive portal traffic or crash events.
- Restrict Access: Temporarily disable captive portal if patching is delayed.
Unit 42 has published detailed technical analysis and IOCs. This is an evolving situation; organizations should monitor Unit 42 blogs for updates.
This is a breaking news story. We will update as more information becomes available.
Related Articles
- 5 Critical Facts About VECT 2.0 Ransomware: The Wiper That Makes Recovery Impossible
- How to Detect and Remediate Malicious Container Images from the KICS and Trivy Supply Chain Attacks
- Unmasking a Hidden DDoS Botnet: How Attackers Turned a Security Firm Against Its Own Clients
- Unit 42 Warns: Endpoint-Only Detection Leaves Networks Exposed – New Data Sources Critical
- 8 Critical Lessons from the Trivy and KICS Docker Hub Supply Chain Attacks in 2026
- Canonical Under Siege: Cyberattack Disrupts Ubuntu, Snap Store, and Launchpad
- AI-Powered Tool Unveils 271 Firefox Security Holes: Largest Single Batch in History
- 10 Things You Must Know About the Bleeding Llama Vulnerability Threatening 300,000 Ollama Deployments