Palo Alto Networks has disclosed active exploitation of CVE-2026-0300, a critical PAN-OS zero-day vulnerability affecting the User-ID Authentication Portal and Captive Portal features on PA-Series and VM-Series firewalls that allows unauthenticated remote code execution (RCE) with root privileges via specially crafted packets. The flaw, caused by a memory corruption and buffer overflow condition within the User-ID Authentication Portal service, has been linked to a suspected state-sponsored espionage cluster tracked as CL-STA-1132, which began unsuccessfully probing vulnerable internet-facing devices as early as April 9, 2026, before successfully achieving RCE roughly one (1) week later by injecting shellcode into nginx worker processes on compromised firewalls. Following initial access, the attackers conducted extensive anti-forensics activity, including clearing kernel crash messages, deleting nginx crash logs and core dump files, and removing other indicators of compromise in an effort to evade detection. Researchers observed the adversaries conducting Active Directory enumeration and deeper post-exploitation reconnaissance while leveraging open-source tunneling and proxy tools such as EarthWorm and ReverseSocks5 (utilities previously associated with multiple China-nexus threat groups) to facilitate persistence and lateral movement. The campaign reportedly escalated further on when attackers generated large volumes of authentication traffic to force failover to a secondary firewall appliance, which they then compromised and equipped with additional remote access tooling. Palo Alto warned that the attackers intentionally relied on intermittent hands-on-keyboard activity and publicly available tooling to remain below behavioral and signature-based detection thresholds. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog despite patches not yet being available. The activity reflects a broader multi-year trend in which state-backed cyber espionage actors increasingly target edge-network infrastructure because these systems provide privileged network access while often lacking the extensive logging, telemetry, and endpoint security controls commonly deployed on traditional endpoints. Until patches are released, CTIX analysts urge organizations to restrict User-ID Authentication Portal access to trusted zones, disable the feature entirely if unused, disable Response Pages on exposed interfaces, and enable Threat ID 510019 protections through Advanced Threat Prevention updates.