CISA Adds One Known Exploited Vulnerability to Catalog
Summary
CISA has added CVE-2026-0300, a Palo Alto Networks PAN-OS out-of-bounds write vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition is part of CISA's Binding Operational Directive 22-01, which mandates remediation for federal agencies and strongly encourages all organizations to prioritize these vulnerabilities.
IFF Assessment
The article highlights a newly identified vulnerability that is actively being exploited, posing a direct threat to organizations and requiring immediate attention for remediation.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: May 09, 2026. Known ransomware use: Unknown.
Defender Context
Defenders must prioritize patching or mitigating CVE-2026-0300, especially if they use Palo Alto Networks devices running PAN-OS, as it is now on CISA's KEV list. Organizations should review their vulnerability management programs to ensure timely patching of actively exploited vulnerabilities.