Exploited in the Wild: Critical PAN-OS Buffer Overflow Grants Root Access to Palo Alto Firewalls

Palo Alto Networks has published an urgent advisory for CVE-2026-0300, a critical CVSS 9.3 buffer overflow in the PAN-OS User-ID Authentication (Captive) Portal that permits unauthenticated remote attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls; limited exploitation has been observed, vendor hotfixes with ETAs are listed, and administrators are advised to restrict or disable the portal, verify exposure, and apply mitigation signatures until patches are available.