Pan-Os

Palo Alto PAN-OS CVE-2026-0300: Unauthenticated Root RCE on Captive Portal Exploited in the Wild, No Patch Until May 13

An unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal hands attackers root on PA-Series and VM-Series firewalls. Limited exploitation is already underway; first patches arrive May 13.