State-Sponsored Actors Weaponize Critical PAN-OS Zero-Day for Root

Palo Alto Networks disclosed a critical buffer overflow (CVE-2026-0300) in the PAN-OS User-ID Authentication Portal (Captive Portal) that allows unauthenticated remote code execution with root privileges on PA-Series and VM-Series firewalls; Unit 42 reports this zero-day has been weaponized by a likely nation-state cluster (CL-STA-1132) engaged in long-term, stealthy intrusions, performing credential theft, tunneling with public tools, log destruction, and identity-focused lateral movement. Immediate mitigations recommended are to restrict portal access to trusted internal IPs, disable the portal if unused, and apply PAN-OS patches immediately.