PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage

**Palo Alto Networks disclosed active exploitation of CVE-2026-0300**, a critical buffer-overflow in the PAN-OS User-ID Authentication Portal allowing unauthenticated RCE as root; unsuccessful probes began April 9, 2026 and later led to successful code execution, shellcode injection, AD enumeration, and deployment of EarthWorm and ReverseSocks5 by a suspected state-sponsored cluster (CL-STA-1132), with mitigations and fixes advised.