Palo Alto Networks warns of firewall RCE zero-day exploited in attacks

Palo Alto Networks has warned of a critical, unpatched PAN-OS User-ID Authentication Portal zero-day (CVE-2026-0300) — a buffer overflow enabling unauthenticated root remote code execution on Internet-exposed PA-Series and VM-Series firewalls. Limited exploitation has been observed in the wild, Shadowserver reports roughly 5,800 exposed VM-series devices, and Palo Alto strongly urges customers to restrict portal access to trusted zones or disable the portal until a patch is released.