Emergency alert: A 9.3 CVSS root-level RCE vulnerability in Palo Alto Networks PAN-OS is under active exploitation.
What CVE-2026-0300 Is
CVE-2026-0300 is a critical remote code execution flaw in Palo Alto Networks PAN-OS, the operating system that runs on the company's next-generation firewalls. It carries a CVSS score of 9.3, which places it near the top of the severity scale, and it grants root-level access — meaning a successful attacker does not land as a constrained user but as the most privileged account on the device.
The vulnerability lives in the portal interface, the web-facing component that handles remote access and management connections. Because portals are frequently exposed to the internet by design, this is exactly the kind of surface that attackers scan for continuously. The combination of network reachability, no authentication barrier that meaningfully slows exploitation, and root outcome is what pushes this into emergency territory.
Why Active Exploitation Changes the Calculus
This is not a theoretical disclosure sitting in a patch queue. It is under active exploitation, which means working attack code is already in use against real systems. When a root RCE on a perimeter firewall is being exploited in the wild, the normal patch-on-your-own-schedule approach no longer applies. Every hour a vulnerable portal stays reachable is an hour it can be compromised.
A firewall is a uniquely bad thing to lose. It sits at the network boundary, inspects traffic, terminates VPN sessions, and often holds credentials and routing to internal segments. Root on that box gives an intruder a durable foothold, a vantage point over traffic, and a pivot into everything the firewall protects. Treat any exposed, unpatched device as potentially already breached rather than merely at risk.
Immediate Response Steps
The priority order is straightforward: reduce exposure, then patch, then hunt for signs you were already hit. If you cannot patch instantly, shrinking the attack surface buys time.
- Apply the vendor fix for CVE-2026-0300 as soon as it is available for your PAN-OS release, treating it as an emergency change rather than a scheduled one.
- Restrict portal reachability — limit management and portal access to trusted networks or a VPN, and remove any unnecessary internet exposure of the interface.
- Review logs and configurations for unexpected admin accounts, changed rules, new certificates, or outbound connections that suggest a foothold.
- Rotate credentials, keys, and certificates that lived on or passed through the device, since root access could have exposed them.
Hunting for Compromise and Hardening After
Patching closes the door, but it does nothing about an attacker who walked through before you locked it. Assume-breach investigation matters here. Look for signs of persistence: modified system files, scheduled tasks or scripts you did not create, tampered logging, and sessions or tunnels originating from unfamiliar addresses. Capture forensic data before you rebuild, because reimaging a device also destroys the evidence of how it was used.
Longer term, treat exposed management planes as a standing liability. Keep firewall portals off the open internet wherever the architecture allows, subscribe to vendor security advisories so critical fixes reach you fast, and rehearse the emergency-patch path in advance. The organizations that weather flaws like this best are the ones that had already minimized exposure and could move quickly when the alert landed.