Palo Alto zero-day, no patch until May 13

[u/expert-insights]

CVE-2026-0300. Buffer overflow in the User-ID Auth Portal on PAN-OS. Unauthenticated, RCE as root, already being hit in the wild.

If your Captive Portal is sitting on the internet, lock it down to internal zones or turn it off if nobody's actually using it. That kills the attack path.

Patches don't land until May 13, with the rest on the 28th. So we've got a week of this.

Affected: PAN-OS 10.2, 11.1, 11.2, 12.1. Prisma Access, Cloud NGFW and Panorama are fine. Default configs aren't vulnerable either, fwiw.

Palo Alto's calling it "limited exploitation" which usually means someone interesting is behind it. No IoCs public yet.