Critical Palo Alto Firewalls Vulnerability Exploited in the Wild to Gain Root Access

Palo Alto Networks disclosed a critical PAN-OS buffer overflow (CVE-2026-0300, CVSS 9.3) in the User-ID Authentication Portal that allows unauthenticated remote attackers to achieve root code execution; limited in-the-wild exploitation has been observed. Multiple PAN-OS branches and versions are affected; vendors have released patches and mitigation guidance (restrict or disable the Authentication Portal) and a Threat Prevention signature is available.