Palo Alto Networks warns of firewall RCE zero-day exploited in attacks

Palo Alto Networks warns of firewall RCE zero-day exploited in attacks

Palo Alto Networks warned customers today that a critical-severity unpatched vulnerability in the PAN-OS User-ID Authentication Portal is being exploited in attacks.

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Palo Alto warns of critical software bug used in firewall attacks

A patch for the bug, tracked as CVE-2026-0300, has not been published yet and Palo Alto Networks said it will be included in releases over the next two weeks.

Palo Alto Networks Firewall Zero-Day Exploited in Active Attacks

Palo Alto Networks recently disclosed a firewall vulnerability that is already being exploited in the wild. The flaw affects the PAN-OS User-ID Authentication Portal and could allow unauthenticated attackers to remotely execute code with root privileges on vulnerable devices. This vulnerability “… allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafte…