Severity: CRITICAL

Source: CISA Known Exploited Vulnerabilities (KEV) Catalog | Published: 6 May 2026 | CVE: CVE-2026-0300

The Threat

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-0300 to its Known Exploited Vulnerabilities Catalog, confirming that malicious actors are actively exploiting this vulnerability in the wild right now. The flaw is an out-of-bounds write vulnerability in Palo Alto Networks PAN-OS, the operating system that powers Palo Alto firewalls and network security appliances deployed by thousands of organisations worldwide.

An out-of-bounds write vulnerability allows an attacker to write data outside the intended memory buffer, which can lead to arbitrary code execution, privilege escalation, or a full system compromise - all without requiring valid credentials in the most severe exploitation scenarios. CISA's inclusion in the KEV Catalog is not theoretical; it signals confirmed, real-world attack activity. This is a five-alarm warning for every network operator running PAN-OS.

Palo Alto Networks firewalls are widely deployed across East African banking institutions, government ministries, telcos, and critical infrastructure operators in Kenya, Ethiopia, Somalia, Djibouti, Uganda, Tanzania, and Rwanda - making this directly relevant to the region.

Impact Assessment for East Africa

Palo Alto PAN-OS is the backbone of perimeter security for many of the region's most sensitive networks. If this vulnerability is successfully exploited, the consequences go far beyond a single device.

  • Banking and Financial Services: Compromised perimeter firewalls give attackers direct access to core banking networks. For institutions operating under CBK (Central Bank of Kenya) Prudential Guidelines or the Bank of Somalia's cybersecurity directives, a breach of this nature triggers mandatory incident reporting and potential regulatory sanctions. A threat actor sitting inside the perimeter of a bank's network can intercept SWIFT transactions, exfiltrate customer data, and move laterally undetected for weeks.
  • Government and GovTech: Ministries and agencies running citizen data systems, immigration databases, revenue platforms, and national ID infrastructure are high-value targets. Exploitation of a border firewall running unpatched PAN-OS could expose entire government networks to espionage or ransomware deployment.
  • Power and Critical Infrastructure: Energy utilities across Kenya (KPLC), Ethiopia (EEP), and Djibouti rely on firewalls to segment operational technology (OT) networks from corporate IT. A PAN-OS exploit that breaches that boundary could allow attackers to reach SCADA systems and disrupt power supply.
  • Telcos and ISPs: Regional ISPs and mobile network operators using Palo Alto appliances at their network edge face the risk of traffic interception and customer data exposure at massive scale.

Many East African organisations lack the 24/7 Security Operations Centre (SOC) coverage needed to detect active exploitation of this type of vulnerability. This gap between exposure and detection is exactly what threat actors exploit.

Immediate Actions - Do These Now

  • Audit your PAN-OS versions immediately. Log in to every Palo Alto firewall and next-generation security appliance in your environment and document the exact PAN-OS version running. Compare against Palo Alto Networks' official security advisory for CVE-2026-0300 to identify affected versions.
  • Apply the vendor patch without delay. CISA's binding operational directive requires U.S. federal agencies to patch KEV-listed vulnerabilities within tight deadlines - treat this same urgency as your own organisational standard. Palo Alto has released patches; deploy them through your standard change management process, but escalate this to emergency priority.
  • Restrict management interface access immediately. If you cannot patch right now, limit access to PAN-OS management interfaces to trusted IP ranges only. Remove internet-facing management access entirely as a temporary mitigation. This reduces the attack surface while you prepare to patch.
  • Review firewall and SIEM logs for signs of exploitation. Look for anomalous traffic patterns, unexpected process execution on firewall appliances, unusual outbound connections from your perimeter devices, and any access to management interfaces from unknown IPs. Treat any anomaly as a potential indicator of compromise (IOC).
  • Notify your incident response team and escalate to your CISO. This is not a routine patch cycle item. Brief your CISO and IT leadership today. If you operate under Kenya's Data Protection Act 2019, the Communications Authority of Kenya's cybersecurity regulations, or any financial sector compliance framework in the region, a confirmed breach of this nature has mandatory disclosure timelines you must be prepared to meet.

DRONGO Recommendation

DRONGO's security engineers have experience hardening Palo Alto environments across East African banking, government, and energy clients. If you are unsure whether your PAN-OS deployment is vulnerable, cannot confirm your patch status, or need rapid log analysis to check for signs of exploitation, we can help - fast.

Is your organisation protected? Request a free security assessment at DRONGO Technology Limited and let our team confirm your exposure to CVE-2026-0300 within 24 hours.