Critical PAN-OS Zero-Day Under Active Exploitation: Urgent Patch Required

By

Breaking: Palo Alto Networks PAN-OS Zero-Day CVE-2026-0300 Exploited in the Wild

Cybersecurity researchers at Unit 42 have confirmed active exploitation of a critical zero-day vulnerability in Palo Alto Networks PAN-OS software. Tracked as CVE-2026-0300, this buffer overflow flaw grants unauthenticated attackers remote code execution capabilities, posing an immediate threat to organizations worldwide.

Critical PAN-OS Zero-Day Under Active Exploitation: Urgent Patch Required
Source: unit42.paloaltonetworks.com

The vulnerability resides in the User-ID Authentication Portal within PAN-OS 10.x and 11.x versions. Attackers can send specially crafted packets to crash the system or execute arbitrary commands without any credentials.

Expert Alert: 'Patch Immediately'

"This is a severe issue — we are seeing active exploitation attempts targeting unpatched firewalls," said a Unit 42 senior analyst. "Organizations must treat this as a top priority patching event. Delay could lead to full network compromise."

Unit 42 urges administrators to understand the attack vector and apply mitigations without delay.

Background: The PAN-OS Captive Portal Flaw

CVE-2026-0300 is a stack-based buffer overflow in the captive portal module of PAN-OS. The captive portal handles authentication for guest users, but insufficient bounds checking allows attackers to overflow a buffer with malicious data.

This vulnerability is particularly dangerous because it requires no prior access — the exploit works from the network boundary. Palo Alto Networks has released security advisory PAN-SA-2024-0002 with patched versions.

Critical PAN-OS Zero-Day Under Active Exploitation: Urgent Patch Required
Source: unit42.paloaltonetworks.com

What This Means for Organizations

Successful exploitation gives attackers complete control over the firewall, enabling lateral movement, data exfiltration, and persistent backdoors. "We have evidence of threat actors using this to drop webshells and pivot into internal networks," the Unit 42 expert added.

Any organization using PAN-OS with captive portal enabled is at risk. The vulnerability impacts both hardware firewalls and virtual deployments. Immediate patching to PAN-OS 10.2.9-h1, 11.0.4-h2, or later is critical.

Recommended Actions

Unit 42 has published detailed technical analysis and IOCs. This is an evolving situation; organizations should monitor Unit 42 blogs for updates.

This is a breaking news story. We will update as more information becomes available.

Related Articles

Recommended

Discover More

In Memory of Tomáš Kalibera: A Pillar of the R Community7 Key Facts About the Historic Commercial Mission to Protect Earth from ApophisMaking Accessibility Intuitive: A Designer’s Step-by-Step Guide to Recognizing Inclusive Design IssuesMastering Amazon S3 Files: Transforming S3 Buckets into High-Performance File SystemsFinal Fantasy 14 Lyricist Turns to Wikipedia's BDSM Page for Raid Song Inspiration