Palo Alto exploited, 1,928 CVEs flagged
- Palo Alto Networks disclosed CVE-2026-0300 on May 6 after in-the-wild attacks hit PAN-OS firewalls, turning exposed Captive Portal services into unauthenticated root-level entry points. - The loudest detail is the access path: no login required, root execution on PA-Series and VM-Series devices, with CISA adding the bug to KEV immediately. - The bigger risk is prioritization failure—headline CVE counts distract from the few exploited flaws that sit directly on enterprise edges.
Firewall bugs are usually bad. Firewall bugs that already got used in real intrusions are worse — because the box that is supposed to be your perimeter just became the attacker’s doorway. That is the real story here. Not the raw count of 1,928 CVEs flying around feeds this week, but the fact that one of them — Palo Alto Networks CVE-2026-0300 — is a live, exploited remote-code-execution bug in PAN-OS, and another heavily discussed bug, CVE-2026-31431, is being misunderstood in cloud triage. ### What actually broke in Palo Alto? CVE-2026-0300 is a buffer overflow in the User-ID Authentication Portal, also called Captive Portal, in PAN-OS. If a PA-Series or VM-Series firewall has that portal enabled and reachable from untrusted networks, an attacker can send crafted packets and get arbitrary code execution as root — with no authentication. Palo Alto marked exploit maturity as “Attacked,” published fixes starting May 5, and said Prisma Access, Cloud NGFW, and Panorama are not affected. (security.paloaltonetworks.com) ### Why is this one so urgent? Because it is not theoretical. Unit 42 said attackers used the bug in limited real-world activity and tracked the cluster as likely state-sponsored. After getting in, the operators dropped tunneling tools like EarthWorm and ReverseSocks5, enumerated Active Directory, and destroyed logs. That combination matters — edge access, lateral movement, and cleanup is basically the nightmare sequence for a perimeter device compromise. (security.paloaltonetworks.com) ### Which systems are exposed? Not every PAN-OS deployment. The exposure depends on configuration. Palo Alto says the vulnerable path exists only when User-ID Authentication Portal is enabled and an interface management profile with response pages is attached on an L3 interface where internet or other untrusted traffic can enter. So the first job is not “patch everything blindly.” It is “find the firewalls with that portal reachable from outside, then move those to the front of the line.” (unit42.paloaltonetworks.com) ### What did CISA do? CISA moved fast. It added CVE-2026-0300 to the Known Exploited Vulnerabilities catalog on May 6, 2026, which is the government’s short list of bugs already being used in attacks. CISA had also added CVE-2026-31431 on May 1. That tells defenders these are not just research curiosities — they are triage items. ### So what is CVE-2026-31431 really? This one is the “Copy Fail” Linux kernel privilege-escalation bug. (security.paloaltonetworks.com) It can let an already authenticated local attacker gain root by abusing a flaw in the algif_aead kernel path. That is serious, especially for multi-tenant Linux environments and container escape scenarios. But Broadcom’s own impact note says VMware ESXi is not affected because ESXi is not Linux, and Photon OS is not affected because it does not use the vulnerable module. So the broad “ESXi/Photon cloud hosts are exposed” framing is wrong. (cisa.gov) ### Where does LiteLLM fit in? LiteLLM did have notable newly cataloged issues, but they are a different class of problem. NVD lists CVE-2026-35029 and CVE-2026-35030, both fixed in v1.83.0. One lets an authenticated user abuse `/config/update` for privilege escalation and possible code execution. The other can let an unauthenticated attacker inherit another user’s identity, but only when JWT/OIDC auth is enabled. Important bugs, yes — but not the same immediate edge-device emergency as the Palo Alto flaw. (knowledge.broadcom.com) ### Why do huge CVE totals mislead people? Because defenders do not patch by volume. They patch by blast radius and exploit reality. A thousand medium-severity disclosures do not outweigh one exploited root bug on an internet-facing firewall. The count is noise. The combination of exposure, exploit status, and device role is the signal. ### Bottom line? Treat this as a prioritization story, not a scoreboard. Hunt for exposed PAN-OS Captive Portal instances first. (nvd.nist.gov) Patch or restrict them immediately. Then handle the Linux and LiteLLM items with the right scope — serious, but not all serious in the same way. (security.paloaltonetworks.com)
