Is CVE-2026-0300 (Palo Alto Networks PAN-OS Out-of-bounds Write) being exploited in the wild?

Yes. CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities catalogue on 6 May 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What “being exploited in the wild” means for this CVE

For a CVE question, the practical meaning of “in the wild” is straightforward: the vulnerability has moved from theoretical risk to confirmed active abuse. That changes the response from routine patch planning to urgent exposure confirmation, rapid remediation, and compromise review. For broader exploit triage, use the CISA Known Exploited Vulnerabilities Catalog alongside the vendor advisory and your asset inventory.

With an exploited network appliance issue, the first question is not whether the CVE is dangerous in the abstract, but whether your environment actually exposes the affected product path. That usually means checking internet-facing appliances, management interfaces, and any adjacent systems that may inherit trust from the device. The Edge Device Security Guide is the right internal reference when the problem sits on the boundary between perimeter exposure, patchability, and device hardening.

The second issue is that active exploitation often means the vulnerability may have been abused before defenders noticed it. Even when the immediate fix is available, logs, admin access history, and configuration changes can reveal whether the appliance was used as an entry point or pivot. The difference between “patched” and “safe” is whether you have checked for earlier compromise and removed any attacker foothold.

Why CISA KEV listing changes the response

CISA adds a CVE to KEV only when it has reliable evidence of active exploitation, so a KEV entry is a prioritisation signal, not just a severity label. That is why KEV-based triage is used to drive emergency remediation, asset scoping, and exception handling. The operational goal is to shrink exposure time before the attacker can reuse the same path at scale, which is why the Zero-Day and Exploited Vulnerabilities Guide is useful here.

For internet-facing products, KEV status also changes the trust posture. Even if you have not observed local abuse, the bar for “acceptable delay” becomes much higher because the weakness is already part of an attacker playbook. The practical decision is whether you can patch immediately, mitigate safely, or isolate the product until remediation is complete.

If the product supports privileged administration or remote management, treat the management plane as part of the blast radius. For network appliances, a successful exploit can expose configuration data, service credentials, or lateral movement opportunities even when the original payload is memory corruption rather than credential theft. The Vulnerability Management Guide covers the prioritisation logic that matters when a CVE is already being used operationally.

What to do before and after remediation

Start with exposure confirmation, then patch or mitigate, then validate whether compromise may already have occurred. That sequence matters because patching alone can erase evidence you needed for forensics. If the device was reachable from untrusted networks, retain logs, export relevant configuration, and review administrative sessions, management logins, unexpected policy changes, and outbound connections around the exploitation window.

Where immediate patching is not possible, use the vendor’s mitigation guidance and reduce reachability as aggressively as you can. For edge and perimeter products, that often means restricting management access, removing unnecessary exposure, and placing compensating controls around the device rather than assuming perimeter placement is enough. The internal guide on edge device hardening is relevant because these systems tend to be high-value, always-on, and difficult to inventory perfectly.

After remediation, the follow-up question is whether adjacent secrets or sessions should be rotated. If the appliance could have exposed administrative access, API credentials, or session material, rotation is often justified even when you do not yet have proof of exfiltration. That decision should be based on reachability, privilege level, and whether the vulnerable system sat in a trusted path to other assets.

Risk and Threat Considerations

Active exploitation of an internet-facing appliance is dangerous because it collapses the usual time gap between disclosure and real-world abuse. Once attackers have a working path, they can use the device as an initial foothold, a pivot point, or a staging platform for follow-on access before routine patch cycles catch up.

Failure mechanism: An out-of-bounds write can produce code execution, crash the process, or create unstable behaviour that attackers chain into reliable foothold establishment on an exposed management or traffic-handling component.

Impact: The likely consequences include unauthorised access, configuration tampering, service disruption, and the need for compromise assessment beyond simple patching.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation makes rapid flaw remediation central to this CVE response.
	AU-6 — Audit Record Review, Analysis, and Reporting	Logs must be reviewed for signs of earlier compromise after exploitation is suspected.
	IR-4 — Incident Handling	Confirmed exploitation requires a compromise-aware response, not only patching.
Recommendation — Prioritise emergency remediation for the vulnerable appliance and track closure of the flaw. Review appliance and adjacent access logs for anomalous activity around the exploitation window. Treat the event as a potential incident and perform compromise assessment before closing it.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Documented	Exposure confirmation depends on knowing where the vulnerable PAN-OS product is deployed.
	RS.MI-01 — Incidents Are Contained	Exploited vulnerabilities require containment to limit further attacker use of the appliance.
Recommendation — Map deployments and verify where the vulnerable product is exposed or reachable. Contain the affected device or path before or while applying the fix.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed active exploitation is a vulnerability management prioritisation problem.
Recommendation — Escalate KEV-listed flaws for urgent remediation and verified closure.

Practitioner Guidance

What to verify: Confirm whether the affected Palo Alto Networks PAN-OS deployment is internet-facing, whether the vulnerable function is reachable, and whether the appliance has been used for administration during the KEV window. If the answer is uncertain, treat it as exposed until proven otherwise.

Decision rule: If patching is available, prioritise immediate remediation over extended testing. If patching must wait, reduce exposure first, then preserve logs and configuration evidence so you can still investigate post-fix.

Practitioner takeaway: KEV listing means the question is no longer “is this exploitable?”, but “have we already reduced exposure and checked for signs of use before the attacker did more damage?”