🤚 The Open-Palm Disclosure

If you run Palo Alto Networks firewalls — and statistically, a disconcerting number of you do — you may want to sit down. Preferably behind a firewall that isn’t currently compromised.

A critical zero-day vulnerability, tracked as CVE-2026-0300, has been actively exploited by suspected state-sponsored hackers since April 9th. That’s nearly a month of quiet, industrious exploitation before anyone thought to mention it publicly. The flaw is a buffer overflow in the PAN-OS User-ID Authentication Portal (also known as Captive Portal), and it grants unauthenticated remote code execution with root privileges. Root. On your firewall. The device whose entire job description is “keep bad things out.”

Affected systems include:

• PA-Series firewalls (Internet-exposed)
• VM-Series firewalls (Internet-exposed)
• Cloud NGFW and Panorama appliances are not affected — small mercies

According to the Shadowserver Foundation, over 5,400 PAN-OS VM-series firewalls are currently exposed online, with 2,466 in Asia and 1,998 in North America. Each one a potential welcome mat with “come in, we’re open” embroidered in buffer overflow.

👐 The Two-Handed Attribution

Palo Alto’s threat intelligence team, Unit 42, has attributed the exploitation to a threat cluster designated CL-STA-1132. The attackers initially fumbled their attempts around April 9th — even state-sponsored hackers have bad days at the office — before achieving successful RCE approximately one week later.

Once inside, the attackers deployed Earthworm, an open-source network tunneling tool, and ReverseSocks5, a proxy tunneling utility. Both tools enable covert communication and firewall/NAT bypass, which is a bit like breaking into a bank and then using the bank’s own security system to monitor the guards. Earthworm has previously been linked to Volt Typhoon, APT41, and other Chinese-speaking threat groups — a résumé that reads less like a LinkedIn profile and more like an Interpol watchlist.

The attackers also performed meticulous log cleanup: clearing crash kernel messages, deleting nginx entries, and removing core dump files. Housekeeping so thorough it would make a five-star hotel concierge weep with professional admiration.

🌿 The Gentle Awakening

Here’s the part that should keep you up at night: patches won’t be available until May 13th. That’s five more days of vulnerability, assuming you’re reading this on publication day. CISA has already added CVE-2026-0300 to the Known Exploited Vulnerabilities Catalog and ordered federal agencies to secure their vulnerable firewalls by May 9th — which is tomorrow, giving sysadmins across the federal government the kind of tight deadline usually reserved for reality television elimination rounds.

Until patches arrive, Palo Alto “strongly” advises:

• Restrict User-ID Authentication Portal access to trusted zones only
• Disable the portal entirely if restriction isn’t feasible
• Check your configuration at: Device > User Identification > Authentication Portal Settings

“Strongly advises” in security parlance means “we are begging you, with corporate-approved intensity.”

👑 The Gold-Leaf Reckoning

There’s a particular irony in a firewall being the attack vector. The device you purchased specifically to be the last line of defense has become the first point of entry. It’s the security equivalent of hiring a bodyguard who hands your house keys to strangers and then carefully shreds the evidence.

This is the third major Palo Alto Networks vulnerability in recent memory to be exploited before a patch was available, and it raises an uncomfortable question that the enterprise security industry would rather not answer: at what point does the security appliance itself become the largest attack surface in your network?

Over 5,400 exposed firewalls. State-sponsored attackers with a month-long head start. Patches still days away. If your organization runs PAN-OS with an Internet-facing Authentication Portal, the time to act was April 9th. The second-best time is right now. The worst time is after you finish reading this article, make a coffee, and add it to next sprint’s backlog.

“The firewall was working exactly as intended — it just intended to work for someone else.” — The Slap of Wisdom Perimeter Defense Bureau, currently operating from behind a very expensive appliance that has been restricted to trusted zones only, thank you for asking