Palo Alto Firewalls Hit by Zero-Day Allowing Arbitrary Code Execution as Root

A devastating zero-day vulnerability in Palo Alto Networks firewalls is under active exploitation by suspected state-sponsored hackers, allowing unauthenticated attackers to seize complete control of enterprise security infrastructure.

The flaw, tracked as CVE-2026-0300 with a critical CVSS score of 9.3, targets the User-ID Authentication Portal service in PAN-OS software and has been weaponized since at least April 9, 2026, giving threat actors weeks to compromise exposed systems before public disclosure on May 6, 2026.

Palo Alto Firewalls Hit by Zero-Day

CVE-2026-0300 stems from a buffer overflow vulnerability in the User-ID Authentication Portal, also known as the Captive Portal service, which enables user identification for unknown network traffic.

Attackers exploit the flaw by sending specially crafted packets to vulnerable PA-Series and VM-Series firewalls, triggering out-of-bounds writes that allow injection of malicious shellcode directly into nginx worker processes.

Successful exploitation grants unauthenticated remote attackers root-level code execution privileges, representing the highest level of system access without requiring any credentials.

The vulnerability affects multiple PAN-OS versions spanning the 10.2, 11.1, 11.2, and 12.1 release branches. At the same time, Prisma Access, Cloud NGFW, and Panorama appliances remain unaffected.

Firewalls are vulnerable only when the User-ID Authentication Portal is enabled and exposed to untrusted networks or the Internet. The risk increases dramatically when management interfaces with response pages are configured on Layer 3 interfaces accessible from untrusted zones.

Palo Alto Networks Unit 42 researchers confirmed limited but targeted exploitation by a threat cluster designated CL-STA-1132, characterized as likely state-sponsored activity of unknown provenance.

Post-exploitation tactics reveal sophisticated adversary capabilities, including the deployment of publicly available tunneling tools such as Earthworm and ReverseSocks5 to establish persistent command-and-control channels.

Attackers demonstrated advanced operational security by conducting Active Directory enumeration using credentials harvested from compromised firewalls and systematically destroying logs and forensic evidence to conceal their presence.

The publication of proof-of-concept exploit code on May 6, 2026, significantly lowered the barrier to exploitation by validating attack mechanics and providing working code that reliably triggers the buffer overflow for root-level remote code execution.

Security researchers warn that the public availability of this exploit materially increases risk for organizations that have not yet applied mitigations.

Affected Versions and Patch Timeline

Multiple PAN-OS versions across four major release branches contain the vulnerability, with patches rolling out in phases throughout May 2026. Fixed versions include PAN-OS 12.1.4-h5 and 12.1.7 for the 12.1 branch; versions 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, and 11.2.12 for the 11.2 branch; versions 11.1.4-h33 through 11.1.15 for the 11.1 branch; and versions 10.2.7-h34 through 10.2.18-h6 for the 10.2 branch.

Several critical hotfixes are expected to have release dates extending to May 28, 2026, leaving organizations awaiting patches exposed.

Organizations running vulnerable configurations should immediately implement one of two primary workarounds until patches can be deployed.

The first option restricts User-ID Authentication Portal access exclusively to trusted internal zones while turning off response pages in interface management profiles attached to Layer 3 interfaces in zones where untrusted or Internet traffic can ingress.

The second mitigation completely disables the User-ID Authentication Portal if the feature is not operationally required by unchecking “Enable Authentication Portal” under Device > User Identification > Authentication Portal Settings.

Security teams should prioritize identifying whether User-ID Authentication Portal services are enabled and exposed to untrusted networks, as this configuration represents the primary attack vector for CVE-2026-0300 exploitation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.