Critical Palo Alto firewall zero-day CVE-2026-0300 under active exploitation, CISA flagged, patches arrive May 13

A critical buffer overflow zero-day in Palo Alto Networks PAN-OS firewalls is being actively exploited in the wild. CVE-2026-0300 lets unauthenticated attackers gain root on PA-Series and VM-Series devices via the User-ID portal. CISA added it to the KEV catalog. First patches ex

A critical buffer overflow zero-day in Palo Alto Networks PAN-OS firewalls is being actively exploited in the wild. CVE-2026-0300 lets unauthenticated attackers gain root on PA-Series and VM-Series devices via the User-ID portal. CISA added it to the KEV catalog. First patches expected May 13.