Palo Alto Networks warns of PAN-OS zero-day exploited by suspected state hackers

Palo Alto Networks disclosed on May 5, 2026, that attackers were exploiting a critical buffer overflow in the User-ID Authentication Portal of its PAN-OS firewall software. The flaw, CVE-2026-0300, lets an unauthenticated attacker run code with root privileges on PA-Series and VM-Series firewalls by sending crafted packets.

The Canadian Centre for Cyber Security published advisory AV26-425 on May 6, noting the reports of active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day.

What happened

Palo Alto's advisory rates the issue critical, with a CVSS 4.0 score of 9.3 when the portal is reachable from untrusted networks. The company said it had seen limited exploitation against portals exposed to untrusted IP addresses or the public internet. Cloud NGFW, Prisma Access and Panorama are not affected.

According to BleepingComputer, Palo Alto's Unit 42 tracks the activity as CL-STA-1132, a cluster of likely state-sponsored activity. Unsuccessful attempts began April 9, and the attackers achieved code execution on one device about a week later. They cleared crash logs and core dumps, then deployed the open-source tunnelling tools EarthWorm and ReverseSocks5. EarthWorm has previously been used by China-linked groups.

The Shadowserver Foundation tracked more than 5,400 exposed PAN-OS VM-Series firewalls, close to 2,000 of them in North America, the outlet reported.

The attacks fit a broader pattern of intruders targeting firewalls, VPNs and other edge devices that often lack the logging and endpoint protection found on servers and laptops. Clearing crash records, as the attackers did here, makes after-the-fact investigation harder.

Fixed versions

Palo Alto later published fixes across supported branches, including PAN-OS 12.1.4-h5 and 12.1.7, 11.2.12, 11.1.15 and hotfix builds on each 10.2, 11.1 and 11.2 train, such as 10.2.18-h6. Unsupported versions must move to a fixed supported release.

What to do

• Upgrade to a fixed PAN-OS release for your train.
• Restrict the User-ID Authentication Portal to trusted zones, and disable Response Pages in interface management profiles on interfaces that face untrusted traffic.
• Disable the portal if you do not use it.
• Threat Prevention subscribers can enable Threat ID 510019 as an added layer.

Administrators can check whether the portal is in use under Device, then User Identification, then Authentication Portal Settings.