Palo Alto Zero-Day Hits Live: CVE-2026-0300 Lets Attackers Take Over PAN-OS Firewalls — The 7-Day UK SME Action Plan Before the 13 May Patch

Palo Alto Networks confirmed this morning that a critical, unauthenticated remote-code-execution flaw in PAN-OS — tracked as CVE-2026-0300 — is being actively exploited in the wild against internet-facing firewalls. The zero-day sits inside the User-ID Authentication Portal (also marketed as the Captive Portal) and stems from a buffer-overflow weakness that lets an attacker, with no credentials and no user interaction, run arbitrary code as root on PA-Series hardware appliances and VM-Series virtual firewalls. A patch is not yet available; Palo Alto Networks has confirmed the first software fixes are scheduled for 13 May 2026, exactly seven days from publication of this article.

The Internet threat-intelligence service Shadowserver is currently tracking more than 5,800 PAN-OS VM-Series firewalls exposed to the public internet, with the largest concentrations in Asia (2,466 instances) and North America (1,998 instances), and a long tail across Europe, the UK and the Middle East. Limited exploitation has already been observed against portals exposed to untrusted IP ranges. For UK SMEs running PAN-OS in any internet-facing role — whether as a primary edge firewall, a remote-worker VPN concentrator, an Azure perimeter VM-Series appliance or an Active Directory User-ID integration point — the next seven days carry a structurally elevated probability of compromise.

What CVE-2026-0300 actually does

The User-ID Authentication Portal — older Palo Alto deployments still call it the Captive Portal — is the PAN-OS feature that authenticates users whose identities cannot be automatically mapped through agent-based User-ID, Group Mapping or Terminal Server agents. In practice it is the web page a guest, contractor or BYOD user hits when their IP is seen but their identity is not yet known to the firewall. The portal then prompts for credentials, validates them, and binds the resulting username to that IP for policy enforcement.

The flaw, disclosed by Palo Alto Networks PSIRT in advisory PAN-SA-2026-0028, is a classic buffer overflow in the way the portal parses certain crafted HTTP request packets. A specially-crafted request — sent over the same TCP/443 listener that serves the portal — overflows an internal buffer and overwrites adjacent memory in a way that hands the attacker arbitrary code execution. Because the portal service runs as root on PAN-OS, that code execution is unrestricted. The attacker does not need a username, a password, an API key or a captured session token. One unauthenticated TCP/443 request, and the firewall is theirs.

The practical implication for a UK SME is severe. A compromised PAN-OS firewall is not just “a server” on your network — it is the device that decides which packets reach every endpoint, every server, every cloud workload behind it. From a root shell on the firewall, an attacker can disable logging silently, rewrite NAT and routing, capture every authentication request flowing through the management plane, harvest GlobalProtect VPN credentials at the moment of authentication, and pivot into Active Directory using the User-ID service account. None of those actions will trigger a Defender alert on a workstation, because none of them touch a workstation. The firewall is, by design, the most-trusted box in your network — and CVE-2026-0300 turns that trust against you.

The 7-day timeline — how this week unfolded

Why this hits UK SMEs harder than the headline suggests

Headlines focus on the global figure of 5,800 internet-exposed VM-Series firewalls. That undercounts the UK SME exposure for three reasons. First, Shadowserver’s figure measures the management plane on its default port; many UK deployments expose the User-ID Authentication Portal on a dedicated FQDN with a non-default certificate, which evades fingerprint-based scanning but does not evade the actual exploit. Second, the figure does not include PA-Series hardware appliances that sit behind upstream equipment and present the portal on an internal interface that is bridged to a public address via NAT. Third, it does not capture the substantial cohort of UK SMEs running Prisma Access in a hybrid model where PAN-OS authentication portals are surfaced to remote workers over the open internet.

The independent Cloudswitched perimeter-discovery dataset — compiled across 327 UK SME networks audited between November 2025 and April 2026 — suggests UK exposure is significantly higher than the headline 5,800 figure implies on a per-business basis. In our sample, 22% of businesses running any PAN-OS product had the User-ID Authentication Portal reachable from at least one public IP without geographic ACLs. Of those, 41% had the portal exposed without a web application firewall in front of it, and 64% had no MFA enforced on portal authentication. None of those gaps are individually unusual; together they form the exact attack surface CVE-2026-0300 is built to exploit.

The wider 2026 perimeter pattern — vendors most affected

CVE-2026-0300 is not a Palo Alto Networks problem. It is a perimeter-device problem. Across the major firewall and remote-access vendor cohort, 2026 is on track to be the heaviest year for actively-exploited zero-days in any device class outside of Windows itself. Compiled from CISA KEV listings, vendor advisories and Shadowserver telemetry over October 2024 to early May 2026:

Source: compiled from CISA KEV catalogue entries, vendor advisories and Shadowserver telemetry, October 2024 – 6 May 2026. Totals count distinct CVEs rated critical and confirmed exploited in the wild. CVE-2026-0300 takes Palo Alto Networks from 5 to 6 critical, actively-exploited perimeter CVEs in the 18-month window.

Where UK SMEs typically have hidden PAN-OS exposure

When Cloudswitched runs perimeter-discovery engagements, the most common PAN-OS finding is not an unpatched feature — it is a forgotten feature. The User-ID Authentication Portal is enabled by default in many PAN-OS template configurations, and stays enabled long after the original use case (typically a single contractor authentication flow or a guest Wi-Fi captive portal) has retired. A second pattern is the User-ID portal exposed via a load-balancer rule that survived a network refresh nobody documented. A third is a PAN-OS VM-Series instance running in Azure or AWS, where the management interface and the data-plane portal share the same public IP — often inherited from a Terraform module that was never security-reviewed.

Two of those high-risk items — portal exposure and unowned features — are the ones that get businesses breached. The other two — shared public IPs and end-of-support branches — are the ones that turn a clean patching exercise into a multi-week migration project. None of them are individually exotic; they are the everyday accumulated drift of a perimeter that has not been re-audited since the device was first racked.

The cost of a PAN-OS edge-device breach — modelled for UK SME bands

Edge-device incidents are not contained in hours. From the first indication of compromise, the response sequence is forensic imaging of the appliance, vendor case engagement, full credential rotation across every user and service account, perimeter and identity hardening, and — in the 30%+ of cases that escalate to encryption — a full ransomware recovery cycle. Modelled against the Cyber Security Breaches Survey 2025/2026 cost data, PwC’s 2026 UK Cyber Cost Index and Cloudswitched’s own engagement record, the cost envelope for a PAN-OS perimeter compromise looks like this:

Costs include incident response, forensic imaging, vendor professional services, full identity-store credential rotation, downtime productivity loss, regulatory notification and additional cyber-insurance excess. They exclude reputational damage and customer-contract clawbacks, both of which add 30–60% to total loss in regulated sectors. Where the PAN-OS appliance also held the User-ID integration with Active Directory, costs at the upper end of each band increase by approximately one-third because of the additional AD recovery and identity-store assurance work that follows.

Reactive patching versus a proactive perimeter programme

The 7-day plan — what to do before the patch ships on 13 May

Below is the response sequence Cloudswitched is using internally and with managed-service customers between today and the scheduled patch on 13 May 2026. It is designed to be executable by a competent in-house IT team, or by a managed provider acting on your behalf, within seven calendar days. Steps 1 to 4 must complete today; step 5 onwards is rolling work to the patch window.

Step-by-step detail

1. Inventory every PAN-OS device in the estate. Pull a list from Panorama if you have it; pull a list from your asset register if you do not. Cross-reference against your monitoring system, your DNS records and your cloud-platform inventories (Azure, AWS, GCP). Many UK SMEs find at least one PAN-OS instance during this step that nobody currently owns — usually a VM-Series in a dev tenancy that quietly graduated to production three years ago.

2. Identify portal exposure on every public IP. For each PAN-OS instance, document whether the User-ID Authentication Portal is enabled, on which interfaces, and whether any of those interfaces are reachable from the open internet. The fastest check is, on each PAN-OS box, Device > User Identification > Authentication Portal Settings, and confirm whether Enable Authentication Portal is ticked. Then map the interface bound to the portal against your perimeter NAT rules. If the answer is “reachable from the open internet” for any device, you are in the high-risk cohort.

3. Disable or trust-zone the User-ID Authentication Portal. Two acceptable mitigations, in order of preference. (a) Disable the portal entirely if you have no current business need. Many UK SMEs find on inspection that the portal is on by default but unused in policy. (b) If the portal is in active use, restrict the source-zone of the portal to trusted internal zones only, and ensure no external NAT or load-balancer rule still steers public traffic to the portal interface. Document the change. Communicate any temporary impact to users (typically only contractors or guests) before the change window.

4. Hunt logs for indicators of compromise. Pull the last 14 days of HTTPS access logs for the portal interface. Look for unusual user-agents, abnormally long URL paths, repeated requests from single IPs to the portal endpoint, or unauthenticated POSTs containing oversized binary payloads. Pull the firewall’s own data-plane logs for outbound TLS sessions to IPs not seen in the last 90 days. Preserve raw logs off-box to your SIEM or to a write-once cold store before any reboot.

5. Rotate all PAN-OS administrative credentials. Local admin accounts, RADIUS- or TACACS-bound admin accounts, the User-ID service account in Active Directory, the API keys used by Panorama, and any automation key bound to your CI or NetOps tooling. If the portal was internet-facing in the last 14 days, treat the management plane as potentially compromised even if no indicator is found. The cost of rotation is small; the cost of leaving an unrotated key behind a now-mitigated portal is unknowable.

6. Enforce MFA on portal, VPN and administrative paths. The portal itself, GlobalProtect, every PAN-OS web-management plane, the Panorama administrative console, the Prisma Access tenant. Single-factor authentication on any of these paths is no longer defensible under Cyber Essentials v3.3 (effective 27 April 2026), under most cyber-insurance policies written this year, or under any sensible reading of NCSC guidance.

7. Capture forensic snapshot before patching. Before applying the 13 May fix, capture a full configuration export, a system-info dump, an output of show jobs all, the full system log archive, and where possible a packet capture of the portal interface for the previous 30 minutes. Many edge-device backdoors are non-persistent across firmware upgrades, which means the upgrade destroys the evidence you would need for an insurance claim, an ICO notification or an Information Tribunal hearing.

8. Notify your cyber insurer and document mitigations. Most 2026-vintage UK cyber policies require notification within 72 hours of becoming aware of an incident or even a credible exposure involving a CISA KEV-listed vulnerability. Submit a notification reference number now, including the dated mitigations applied (portal disabled or trust-zoned, MFA enforced, logs preserved, credentials rotated). Silence at the start of an incident is the single most-cited reason insurers later refuse cover.

9. Apply the patch within 72 hours of the 13 May release. Stage the patch in a non-production HA pair first if you have one. Apply during a published change window. Confirm the User-ID Authentication Portal is patched against CVE-2026-0300 in show system info, then re-enable the portal in its normal trust-zone configuration if you disabled it. Document the firmware version before and after, the exact UTC timestamp of the change, and the engineer who made the change.

10. Schedule a 30-day follow-up perimeter review. CVE-2026-0300 is the symptom; the underlying problem is that perimeter devices are inspected once at deployment and rarely afterwards. Within 30 days, schedule a structured review covering asset inventory, firmware lifecycle, management-plane exposure, MFA enforcement, log shipping, configuration backup and a tested restore. That review is what determines whether the next perimeter zero-day is a patch event or an incident.

At-a-glance summary

Putting this in context with the wider 2026 cyber picture

CVE-2026-0300 lands in a year already shaped by perimeter compromise. The UK government’s Cyber Security Breaches Survey 2025/2026 reported a doubling of breaches with revenue impact. The Fortinet and Cisco zero-days covered in our 21 April analysis defined a single working week in which two of the largest enterprise vendors shipped emergency hotfixes. The 27 April 2026 launch of Cyber Essentials v3.3 with the Danzell question set introduced the first auto-fail trigger in the scheme’s history for unpatched internet-facing critical CVEs. The government’s 22 April Cyber Resilience Pledge and £90m SME fund placed cyber resilience at board level and pushed Cyber Essentials through every supply chain. And the 22 April warning from the UK’s most senior security official confirmed that state-backed actors are scaling against UK businesses of every size. Read together, those five news cycles describe the operating environment in which CVE-2026-0300 will be weaponised over the next fortnight.

Frequently asked questions

Closing — the seven days that will define your perimeter

Between this article and the patch on 13 May 2026, every UK SME running PAN-OS at the edge has a single decision to take and follow through. Either you treat the User-ID Authentication Portal as a live exposure today, mitigate it before close of business, and operate to the 7-day plan above — or you carry the risk of an unauthenticated root-level compromise on the most-trusted box in your network until the patch lands. Cyber Essentials v3.3, the Cyber Resilience Pledge and the £90m SME fund all point in the same direction: the regulatory, insurance and customer-supply-chain expectations of UK SMEs in 2026 are not compatible with a passive approach to the perimeter.

If you would like a Cloudswitched engineer to walk through your specific PAN-OS estate against the 7-day plan — identifying every appliance, every internet-facing portal interface, every mitigation status, and producing a named-owner remediation pack you can hand to your insurer or your Cyber Essentials assessor — book the no-obligation call below. The week is short. The patch ships in seven days. The mitigation can ship today.

CloudSwitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.