Palo Alto Networks to Patch Zero-Day Exploited to Hack Firewalls
Palo Alto Networks is working on patches for a critical PAN-OS zero-day that has been exploited to hack some of the company’s firewall models.
Tracked as CVE-2026-0300, the vulnerability has been described as a buffer overflow affecting the User-ID Authentication Portal (Captive Portal) service of PAN-OS software.
The zero-day affects PA and VM series firewalls, allowing an unauthenticated attacker to execute malicious code with root privileges via specially crafted packets.
“Limited exploitation has been observed targeting Palo Alto Networks User-ID Authentication Portals that are exposed to untrusted IP addresses and/or the public internet,” Palo Alto Networks said in an advisory.
No other information has been shared about the attacks exploiting CVE-2026-0300, but limited exploitation typically indicates that a flaw has been leveraged in highly targeted attacks by sophisticated threat actors, often state-sponsored groups.
The vendor is aiming to release the first round of patches on May 13, with a...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
