Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

A critical zero-day in Palo Alto Networks PAN-OS Captive Portal (CVE-2026-0300) is being exploited by likely state-sponsored attackers to achieve unauthenticated remote code execution on firewalls, enabling stealthy, root-level access and lateral movement using open-source tunneling tools while erasing evidence of compromise.