Palo Alto Firewall Zero-Day CVE-2026-0300: Nation-State Hackers Had Root Access for a Month

CVE-2026-0300 PAN-OS is the vulnerability that every security team feared. Your enterprise firewall — the one device that’s supposed to keep attackers out — just became their front door. Palo Alto Networks has confirmed that CVE-2026-0300, a critical buffer overflow vulnerability in PAN-OS, has been actively exploited by suspected nation-state actors for nearly a month before anyone noticed. The flaw gives unauthenticated attackers root-level remote code execution on PA-Series and VM-Series firewalls — no credentials required, no user interaction needed, CVSS score of 9.3.

This isn’t a theoretical vulnerability that might be exploited someday. Unit 42, Palo Alto’s own threat intelligence team, confirmed that attackers began exploitation attempts as early as April 9, 2026, achieved successful remote code execution by mid-April, deployed tunneling tools, harvested Active Directory credentials, and wiped their tracks. The patch? Still not available — the first fixes are expected on May 13, 2026.

What Is CVE-2026-0300 PAN-OS and Why Is It So Dangerous?

CVE-2026-0300 is an unauthenticated buffer overflow vulnerability in the User-ID Authentication Portal (also known as the Captive Portal) service of PAN-OS. In technical terms, it’s a CWE-787 out-of-bounds write — an attacker sends specially crafted packets to the portal service, which triggers a buffer overflow that allows arbitrary code execution with full root privileges on the firewall itself.

Let that sink in: root access on your firewall. Not a limited user account. Not a sandboxed process. Full, unrestricted root access to the device that controls all traffic flowing in and out of your network. An attacker with root on your firewall can intercept traffic, modify firewall rules to allow future access, pivot into your internal network, exfiltrate data, and do all of this while remaining completely invisible to your security monitoring — because they control the monitoring device itself.

The CVSS score of 9.3 applies when the User-ID Authentication Portal is configured to accept connections from the internet or any untrusted network. Given that many organizations expose this portal for remote employee authentication, VPN pre-login pages, or guest network access, the attack surface is significant.

The Attack Chain: How Nation-State Hackers Got In

According to Help Net Security and Unit 42’s threat brief, the exploitation followed a methodical, multi-stage attack chain that screams advanced persistent threat (APT) sophistication.

Stage 1: Reconnaissance (Early April 2026) — The attackers probed internet-facing Palo Alto firewalls with specially crafted packets, testing for the vulnerability. Starting April 9, Unit 42 observed unsuccessful exploitation attempts against target devices — the attackers were calibrating their exploit.

Stage 2: Exploitation (Mid-April 2026) — Approximately one week after initial reconnaissance, the attackers achieved successful remote code execution. They injected shellcode directly into the firewall’s memory, gaining root-level access without triggering any authentication prompts or security alerts.

Stage 3: Persistence & Lateral Movement — Once inside, the attackers deployed EarthWorm and ReverseSocks5 tunneling tools, creating covert communication channels back to their infrastructure. They used stolen credentials to probe Active Directory, mapping the victim’s internal network structure and identifying high-value targets.

Stage 4: Evidence Destruction — In a move characteristic of sophisticated state-sponsored operations, the attackers deleted logs and forensic evidence to hide their intrusion. This anti-forensics step makes it extremely difficult for incident responders to determine exactly what data was accessed or exfiltrated.

Which Firewalls Are Affected?

The vulnerability affects PA-Series (physical hardware) and VM-Series (virtual) firewalls running the following PAN-OS branches: PAN-OS 10.2, 11.1, 11.2, and 12.1. These cover the vast majority of actively deployed Palo Alto firewalls in enterprise environments worldwide.

Critically, Prisma Access (Palo Alto’s cloud-delivered security), Cloud NGFW (cloud-native next-gen firewall), and Panorama management appliances are not affected. This follows a familiar pattern — similar to the SharePoint zero-day CVE-2026-32201 where cloud versions were unaffected while on-premises deployments were vulnerable. The security industry’s push toward cloud-managed infrastructure gains another data point in its favor.

The specific vulnerable component is the User-ID Authentication Portal — the Captive Portal feature that organizations use for user authentication before granting network access. If your firewall has this portal enabled and accessible from untrusted networks (including the internet), you’re in the blast radius.

No Patch Yet — And That’s the Scary Part

As of May 12, 2026, no patch is available. Palo Alto Networks acknowledged the vulnerability on May 6 and stated that the first software fixes are expected on May 13, 2026. That means organizations have been exposed for over a month since active exploitation began, and even now, the only available mitigations are workarounds — not fixes.

Palo Alto’s recommended mitigations include disabling the User-ID Authentication Portal if it’s not strictly needed, restricting access to the portal to trusted IP addresses only using interface-level ACLs, and enabling Threat Prevention signatures (if available) to detect exploitation attempts. But these are band-aids. The fundamental vulnerability remains until a patch is deployed, and organizations that rely on the Captive Portal for core functionality can’t simply turn it off without breaking their authentication workflows.

The Irony of Firewall Vulnerabilities

There’s a cruel irony in firewall zero-days that doesn’t apply to most other software vulnerabilities. When your email server gets hacked, your firewall can still detect suspicious outbound traffic. When your web server gets compromised, your intrusion detection system can flag anomalous behavior. But when your firewall itself is compromised, the attacker controls the very device responsible for detecting and blocking malicious activity.

This is why CVE-2026-0300 is far more dangerous than its already-alarming CVSS score suggests. A compromised Palo Alto firewall can be configured to silently allow attacker traffic while continuing to block everything else normally — making the compromise virtually undetectable through network monitoring alone. The attacker effectively becomes invisible to every security tool that depends on the firewall for visibility.

This isn’t the first time Palo Alto firewalls have been targeted. The company faced similar critical vulnerabilities in 2024 with CVE-2024-0012 and CVE-2024-9474, which were also actively exploited. The recurring pattern of firewall zero-days — across Palo Alto, Fortinet, Cisco, and other vendors — suggests that network security appliances are becoming prime targets for advanced threat actors who understand that compromising the security device itself provides the most strategic advantage.

Who’s Behind the Attacks?

While Palo Alto hasn’t publicly attributed the attacks to a specific group, the characteristics strongly suggest state-sponsored actors. The evidence points in this direction for several reasons: the sophisticated multi-stage attack chain with custom shellcode, the use of EarthWorm (a tunneling tool frequently associated with Chinese APT groups), the focus on Active Directory reconnaissance (indicating long-term strategic objectives rather than opportunistic cybercrime), the careful anti-forensics including log deletion, and the fact that the vulnerability was discovered and weaponized before the vendor was aware of it.

Security Affairs reports that the exploitation pattern is consistent with espionage-focused operations targeting government and critical infrastructure organizations — exactly the kind of targets that deploy enterprise-grade Palo Alto firewalls.

What You Should Do Right Now

If your organization runs Palo Alto PA-Series or VM-Series firewalls, here’s your immediate action plan. Check your Captive Portal exposure — determine whether the User-ID Authentication Portal is enabled and accessible from untrusted networks. If it is, restrict access immediately using interface ACLs. Apply the patch the moment it drops — May 13 is the target date. Have your change management process ready to fast-track deployment. Hunt for indicators of compromise — review firewall logs for unusual activity dating back to early April 2026. Look for unexpected outbound connections, unfamiliar tunneling traffic, or gaps in log continuity that might indicate deletion.

If you find evidence of exploitation, assume the firewall is fully compromised. Don’t just patch it — rebuild it from a clean image. An attacker with root access could have modified the firmware, installed persistent backdoors, or altered the device’s security policies in ways that survive a simple software update. Also assume that any credentials that traversed the firewall may be compromised, and rotate them accordingly.

The Bottom Line

CVE-2026-0300 is the kind of vulnerability that keeps CISOs awake at night — and it should. A CVSS 9.3 unauthenticated RCE in a firewall product, actively exploited by nation-state actors for a month before disclosure, with no patch available for over a week after public acknowledgment. The attackers had root access to the one device that’s supposed to protect everything else.

The lesson here isn’t just “patch your firewalls” — it’s that security devices themselves are high-value targets. The same sophistication that makes enterprise firewalls effective security tools makes them devastatingly effective attack platforms when compromised. If you’re running Palo Alto, the patch drops tomorrow. Don’t wait until the change advisory board meets next Thursday.

Related reading: SharePoint Zero-Day CVE-2026-32201: 1,300 Servers Exposed | cPanel Zero-Day CVE-2026-41940: 44K Servers Hacked | 2026: Year of AI-Assisted Attacks | Pentagon AI Deals 2026

Related Reading

If you found this article interesting, check out these related stories: SharePoint zero-day CVE-2026-32201, cPanel zero-day that hit 44K servers, CISA CI Fortify initiative. Also worth reading: Dirty Frag kernel exploit and Mandiant’s report on AI-assisted attacks.