State-backed hackers hammer Palo Alto firewall zero-day before patch lands

State-backed hackers have been quietly exploiting a fresh zero-day in Palo Alto Networks firewalls to gain root access with no login required. The flaw, tracked as CVE-2026-0300 and carrying a CVSS severity rating of 9.3, affects the Captive Portal feature in PAN-OS on PA-Series and VM-Series firewalls. Palo Alto said the issue stems from a memory corruption bug in the User-ID Authentication Portal, a feature used to handle logins for users the firewall cannot automatically identify. If successfully exploited, the bug allows attackers to remotely run arbitrary code on internet-exposed devices with root privileges. According to the vendor’s Unit 42 threat intelligence team, attacks are already underway and tied to a cluster of "likely state-sponsored threat activity" tracked as CL-STA-1132. The attackers allegedly used the zero-day to inject shellcode into an nginx worker process running on compromised devices. Palo Alto said the first failed exploitation attempts began on April 9. About a week later, the attackers successfully achieved remote code execution on a targeted firewall and then cleared logs, crash reports, and other records tied to the compromise. The attackers later used their access to move deeper into victims’ networks, including probing Active Directory systems while continuing to clean up traces of the intrusion from compromised devices. According to Palo Alto, the campaign expanded again on April 29 when the attackers triggered a flood of authentication traffic that caused a secondary firewall to take over internet-facing duties. The attackers then compromised that device as well and installed additional remote access tools. CISA has already shoved the flaw into its Known Exploited Vulnerabilities catalog, which is usually the government’s polite way of saying "patch this before your weekend disappears." There’s just one snag: there is no patch yet. Until one arrives, Palo Alto is urging customers to either lock down the User-ID Authentication Portal so it is reachable only from trusted networks or disable it entirely. The warning also lands after a rough run for PAN-OS customers. Palo Alto firewalls have been a regular target for attackers over the past two years, with multiple zero-day campaigns hitting internet-facing devices before patches were widely deployed. In many cases, attackers chained together flaws to break into networks through the very boxes meant to keep them out. ®