Nation-State Actors Exploited Palo Alto Networks PAN-OS Zero-Day for Nearly a Month

Palo Alto Networks reported that suspected nation-state actors exploited a critical zero-day vulnerability (CVE-2026-0300) in PAN-OS for nearly a month, gaining root access to exposed firewalls. Attackers deployed tunneling tools such as EarthWorm and ReverseSocks5 and used stolen credentials to maintain persistence. The flaw allowed threat actors to hide their traces after compromising systems. No specific dates or targeted regions were disclosed in the report. The vulnerability affects PAN-OS, the operating system used in Palo Alto Networks firewalls.