Palo Alto Networks Firewall Zero-Day RCE Vulnerability Exploited in the Wild Since April

**Active zero-day exploitation of PAN-OS Captive Portal (CVE-2026-0300):** Unit 42 reports a likely state-sponsored campaign (CL-STA-1132) exploiting a buffer overflow in the PAN-OS User-ID Authentication Portal to achieve unauthenticated root RCE, deploy public tunneling tools (EarthWorm, ReverseSocks5), perform AD enumeration and cleanup forensic artifacts; the advisory includes IOCs and immediate mitigations (restrict or disable the Authentication Portal).