Palo Alto Networks Zero-Day Exploited to Hack Firewalls

Palo Alto Networks is set to patch a critical zero-day vulnerability, CVE-2026-0300, which SecurityWeek reports is actively being exploited in the wild. This flaw specifically impacts the Captive Portal service within PAN-OS software, affecting both PA and VM series firewalls.

This isn’t just another vulnerability; it’s a zero-day actively leveraged against critical network infrastructure. Attackers are clearly targeting the perimeter, aiming for initial access to corporate networks. The exploitation of a firewall, especially through a service like Captive Portal, offers a high-value entry point, potentially bypassing traditional perimeter defenses and gaining a foothold for lateral movement or data exfiltration.

For defenders, this means immediate action. Firewalls are the bedrock of network security, and any compromise here is catastrophic. The attacker’s calculus is straightforward: find the weakest link at the edge, exploit it, and then move deeper. A successful exploit of this zero-day could grant persistent access, enabling long-term espionage or disruptive attacks.