CVE-2026-0300 in Palo Alto Networks PAN-OS: Actively Exploited Zero-Day Added to CISA KEV

Technical Analysis

CVE-2026-0300 is a remote code execution (RCE) vulnerability in Palo Alto Networks' PAN-OS. The specific vulnerability class and preconditions for exploitation are not detailed in the available intelligence. However, reporting indicates that successful exploitation allows an attacker to gain root-level access to the underlying operating system of the affected device. This level of access would grant an attacker complete control over the network security appliance, enabling traffic interception, lateral movement, and data exfiltration.

CONFIRMED evidence from CISA and REPORTED information from security news outlets indicate the exploit is being used in the wild for espionage campaigns. The high reported CVSS score of 9.3, combined with root-level access, suggests the vulnerability is likely unauthenticated and remotely triggerable, affecting the network perimeter directly. The exact attack vector remains unspecified.

Affected Systems

Intelligence Context

The addition of CVE-2026-0300 to the CISA KEV catalog is the primary driver for prioritization. This action provides CONFIRMED evidence of active, in-the-wild exploitation. The 'ZERO-DAY RACE' label indicates that attackers were exploiting this vulnerability before a patch was available. The EPSS score of 0.14897 is relatively low, which is typical for targeted, non-widespread zero-day exploitation where predictive models have not yet ingested sufficient public exploit data. Defenders must disregard the low EPSS score and prioritize action based on the KEV status, which reflects observed reality over predictive probability.

Remediation & Defense

Source Timeline

• portal.auscert.org.au — First reporter
• thehackernews.com — Corroborating report
• cisa.gov/kev — Official exploitation confirmation