PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage

A critical buffer overflow vulnerability, designated as CVE-2026-0300, has been discovered in the User-ID Authentication Portal service of Palo Alto Networks' PAN-OS software, carrying a CVSS score of 9.3/8.7. This flaw could potentially enable an unauthenticated attacker to gain root access, thereby facilitating espionage and other malicious activities. Threat actors are believed to have attempted to exploit this vulnerability as early as April 9, 2026, although these attempts are thought to have been unsuccessful¹. The vulnerability's high severity score underscores the need for prompt attention from security teams. Given the active discussion surrounding the exploitation status of CVE-2026-0300, security practitioners must closely monitor the situation to determine whether immediate patching or continued monitoring is the most appropriate course of action. This vulnerability's potential for enabling root access and espionage makes it a pressing concern for organizations relying on PAN-OS software, so it is crucial for security teams to stay vigilant and prepared to respond to potential exploits.