Palo Alto Networks Firewall Zero-Day Exploited in Campaign With Possible China Links
Summary
Palo Alto Networks says attackers exploited CVE-2026-0300 for root-level remote code execution in its firewalls, using tunneling tools and deleting logs. The company has not attributed the campaign to a specific country.
Key points
- CVE-2026-0300 affects the User-ID Authentication Portal on PA and VM series firewalls and allows unauthenticated remote code execution with root privileges.
- Palo Alto Networks says exploitation attempts began April 9 and succeeded about a week later.
- The company attributes the activity to the likely state-sponsored group CL-STA-1132, but has not identified a specific country.
- After gaining access, attackers reportedly injected shellcode into an Nginx worker process and deleted logs and crash-dump evidence.
- Attackers later deployed Earthworm and ReverseSocks5, then used firewall service-account credentials for Active Directory enumeration.
- Patches were expected on May 13 and May 28; Palo Alto Networks provided interim mitigations and workarounds.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution (RCE)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unavailable
MITRE ATT&CK
T1055 · Process InjectionAttackers injected shellcode into an Nginx worker process after successfully exploiting the vulnerability.T1070.004 · File DeletionAfter compromising a firewall, attackers deleted Nginx crash records, crash core dump files, and ptrace injection evidence from the audit log.T1090 · ProxyAttackers deployed ReverseSocks5, which the article says allows them to bypass firewalls and NAT.T1190 · Exploit Public-Facing ApplicationThe vulnerability in the User-ID Authentication Portal was exploited remotely to gain code execution on PA and VM series firewalls.T1572 · Protocol TunnelingAttackers deployed Earthworm, which the article describes as a network-tunneling tool for establishing a covert communications channel.