Reported by 3 outlets

Timeline

1. original reporting

   Palo Alto Networks PAN-OS zero-day (CVE-2026-0300) — unauthenticated RCE with root on firewalls, actively exploited, no patch for 7+ days

   bleepingcomputer.com · 161d ago · May 6th, 2026

   Palo Alto Networks has disclosed a critical buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal (Captive Portal) that is being actively exploited in attacks. Tracked as CVE-2026-0300 with a CVSS 4.0 score of 9.3, the flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges by sending specially crafted packets to exposed firewalls. PA-Series and VM-Series appliances running PAN-OS 10.2, 11.1, 11.2, and 12.1 are affected. Shadowserver is tracking over 5,800 internet-exposed VM-Series firewalls, with the largest concentrations in Asia (2,466) and North America (1,998). Palo Alto Networks describes exploitation as "limited" — a phrasing that historically indicates targeted state-sponsored operations. Patches are not expected until a staggered rollout between May 13 and May 28, 2026. Until then, the only mitigation is restricting the User-ID Authentication Portal to trusted internal network zones or disabling it entirely. Prisma Access, Cloud NGFW, and Panorama appliances are not affected. Palo Alto firewalls are used by over 70,000 organizations including 90% of Fortune 10 companies and most major U.S. banks.

2. update from unit42.paloaltonetworks.com

   PAN-OS CVE-2026-0300 — Unit 42 reveals exploitation timeline, CL-STA-1132 cluster, and AD lateral movement from firewall credentials

   unit42.paloaltonetworks.com · 160d ago · May 7th, 2026

   New technical details from Unit 42's incident response show that exploitation of CVE-2026-0300 began with unsuccessful attempts on April 9, 2026, with successful unauthenticated RCE achieved one week later. The attackers injected shellcode into an nginx worker process, immediately cleaned crash logs and core dumps to evade detection, then waited four days before deploying tools. Post-exploitation activity included EarthWorm (a multi-platform SOCKS5 tunneling tool previously used by Volt Typhoon and APT41) and ReverseSocks5 for persistent network pivoting. Critically, the attackers leveraged the firewall's service account credentials to enumerate Active Directory, targeting domain root and DomainDnsZones. Unit 42 tracks the cluster as CL-STA-1132 and assesses it as likely state-sponsored. On April 29, the attackers conducted a SAML flood to force a second device to become Active, then achieved RCE on that device as well — demonstrating a deliberate dual-device compromise strategy. Palo Alto's Advanced Threat Prevention can block attacks with Threat ID 510019 from content version 9097-10022.

3. update from securityweek.com

   PAN-OS CVE-2026-0300 — CISA adds to KEV, SecurityWeek confirms Chinese state-sponsored hallmarks

   securityweek.com · 159d ago · May 8th, 2026

   CISA has added CVE-2026-0300 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to apply mitigations immediately. Separately, SecurityWeek analysis confirms the CL-STA-1132 exploitation cluster bears hallmarks of Chinese state-sponsored operations — the deployment of Earthworm and ReverseSocks5 (tools predominantly used by Volt Typhoon and APT41), systematic log destruction, and Active Directory targeting are consistent with Chinese APT tradecraft. The attackers relied entirely on open-source tooling rather than proprietary malware, which minimized signature-based detection and allowed seamless environment integration over multi-week interactive sessions. Patches remain on a staggered timeline of May 13–28.