Critical PAN-OS Zero-Day Under Active Exploitation: Urgent Patch Required
Breaking: Palo Alto Networks PAN-OS Zero-Day CVE-2026-0300 Exploited in the Wild
Cybersecurity researchers at Unit 42 have confirmed active exploitation of a critical zero-day vulnerability in Palo Alto Networks PAN-OS software. Tracked as CVE-2026-0300, this buffer overflow flaw grants unauthenticated attackers remote code execution capabilities, posing an immediate threat to organizations worldwide.
The vulnerability resides in the User-ID Authentication Portal within PAN-OS 10.x and 11.x versions. Attackers can send specially crafted packets to crash the system or execute arbitrary commands without any credentials.
Expert Alert: 'Patch Immediately'
"This is a severe issue — we are seeing active exploitation attempts targeting unpatched firewalls," said a Unit 42 senior analyst. "Organizations must treat this as a top priority patching event. Delay could lead to full network compromise."
Unit 42 urges administrators to understand the attack vector and apply mitigations without delay.
Background: The PAN-OS Captive Portal Flaw
CVE-2026-0300 is a stack-based buffer overflow in the captive portal module of PAN-OS. The captive portal handles authentication for guest users, but insufficient bounds checking allows attackers to overflow a buffer with malicious data.
This vulnerability is particularly dangerous because it requires no prior access — the exploit works from the network boundary. Palo Alto Networks has released security advisory PAN-SA-2024-0002 with patched versions.
What This Means for Organizations
Successful exploitation gives attackers complete control over the firewall, enabling lateral movement, data exfiltration, and persistent backdoors. "We have evidence of threat actors using this to drop webshells and pivot into internal networks," the Unit 42 expert added.
Any organization using PAN-OS with captive portal enabled is at risk. The vulnerability impacts both hardware firewalls and virtual deployments. Immediate patching to PAN-OS 10.2.9-h1, 11.0.4-h2, or later is critical.
Recommended Actions
- Apply Security Updates: Upgrade to fixed PAN-OS versions listed in the advisory.
- Monitor for Indicators: Check firewall logs for unusual captive portal traffic or crash events.
- Restrict Access: Temporarily disable captive portal if patching is delayed.
Unit 42 has published detailed technical analysis and IOCs. This is an evolving situation; organizations should monitor Unit 42 blogs for updates.
This is a breaking news story. We will update as more information becomes available.
Related Articles
- How Russian Hackers Exploited Obsolete Routers to Hijack Microsoft Office Authentication
- Critical Flaw in Linux Kernel's AEAD Sockets: Arbitrary Page Cache Writes Expose Systems to Attack
- Global Telecom Espionage Campaign Disrupted: Google and Mandiant Take Down GRIDTIDE Backdoor
- April 2026 Patch Tuesday: Record-Breaking Security Updates Address 167 Flaws, Including Actively Exploited Vulnerabilities
- AI-Powered Hacker Breaches Nine Mexican Government Agencies, Steals Hundreds of Millions of Records
- AI Red Team Expert Reveals Tactics for Breaking Machine Learning Models to Strengthen Defenses
- Massive Facebook Account Heist: Over 30,000 Compromised in New Google AppSheet Phishing Scheme
- How to Check Your Windows Webcam Access Logs for Suspicious Activity