5SEP

CISA deadline for PAN-OS RCE lands four days early

3 min read

12:09UTC

CISA added CVE-2026-0300 to the Known Exploited Vulnerabilities catalogue on 6 May with a 9 May federal deadline. Palo Alto Networks will not ship a patch until 13 May, the first documented instance of a KEV deadline arriving before the vendor fix exists.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A KEV deadline arriving four days before the vendor patch exposes the compliance programme's foundational assumption.

CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities (KEV) catalogue on Wednesday 6 May, setting a federal remediation deadline of Saturday 9 May.⁠¹ The flaw is an unauthenticated remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS firewalls, carrying a Common Vulnerability Scoring System (CVSS) score of 9.3 and triggered by a crafted packet to the User-ID Authentication Portal (the captive portal used for guest-network access).⁠² Palo Alto's own advisory states first patches will not ship until Wednesday 13 May, four days after the federal deadline.⁠³ That four-day gap is without documented precedent in the KEV programme's history.

Federal Chief Information Security Officers face a binary. They can restrict the User-ID portal to trusted zones and disable Response Pages (the official mitigation), or they can document non-compliance. Neither constitutes a patch. The compliance machinery the programme runs on was built on the implicit assumption that a vendor fix precedes or accompanies a KEV listing. That assumption has now failed in writing, for the first time.

CISA's three-day remediation cadence, applied to Cisco Catalyst SD-WAN Manager in April and embedded in the multi-agency deadline doctrine from the IOC advisory, appears to have been applied reflexively here, without accounting for a case where no fix yet exists. Private-sector organisations that use KEV listings as a contractual service-level basis face the same structural problem in their procurement and insurance frameworks. The deadline lands on paper regardless of whether the vendor has shipped.

Deep Analysis

In plain English

CISA is the US government agency that tells federal departments which software flaws to fix, and by when. When a flaw appears on its KEV list, government agencies must fix it by the deadline or formally document why they cannot. In this case, CISA set a 9 May deadline for a critical flaw in Palo Alto's PAN-OS firewall software. But Palo Alto itself said it would not have the fix ready until 13 May. That is four days after the deadline. This has never happened before on record. Agencies are legally required to patch but physically cannot, because the patch does not exist. The only option is to apply a workaround, not a fix, and document that. The case exposes a gap in how the rules are written: the rules assumed the vendor would always have a patch ready by the time the deadline was set.

Deep Analysis

Root Causes

CISA's KEV programme operates on a policy assumption that is now exposed in print: that a vendor will have shipped, or will ship within hours, a patch for any vulnerability already under active exploitation. The Binding Operational Directive 22-01 (November 2021) sets no minimum patch-availability criterion before a deadline can be issued.

The underlying structural cause is a co-ordination gap between CISA's KEV publication pipeline and vendor patch release cycles. Large enterprise vendors such as Cisco and Fortinet have structured CERT relationships with CISA that create informal pre-publication alignment. Palo Alto Networks has such a relationship, but the CVE-2026-0300 timeline suggests the patch schedule was not factored into the deadline-setting process before publication.

The second cause is the legal architecture of KEV itself: it is a federal mandate, not a recommendation. Agencies cannot defer or document-and-skip without formal non-compliance record. The programme was designed for accountability, not flexibility, and that design leaves no compliant path when the vendor fix does not exist.

What could happen next?

Precedent
CISA will be under pressure to add a vendor-patch-availability check to the KEV publication workflow, which may slow future KEV additions for complex enterprise products.
Short term · 0.7
Risk
Private-sector organisations using KEV as a contractual SLA face ambiguous insurance posture for the nine days between the deadline and the patch ship date.
Immediate · 0.8
Consequence
Federal CISOs must now maintain a documented record of deadline-before-patch non-compliance, which creates a legally visible audit trail that future administrations or inspectors general may scrutinise.
Medium term · 0.75

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In 2019, when Microsoft issued an emergency advisory for BlueKeep (CVE-2019-0708), CISA's predecessor agency DHS-CISA sent a Binding Operational Directive to agencies within 48 hours, with a two-week remediation window. That window aligned with the patch Microsoft shipped simultaneously with the advisory, so compliance was tractable. The KEV programme formalised that assumed alignment in 2021 without making it explicit.

Counter-parallel: The PrintNightmare (CVE-2021-34527) episode showed the reverse failure: Microsoft shipped an out-of-band patch within six days of disclosure, but initial guidance from CISA was incomplete and agencies over-patched, disabling legitimate printing infrastructure. Speed alone, without vendor co-ordination, produced operational harm even when the patch existed.

Federal agencies using Palo Alto Networks perimeter kit face immediate cost exposure: the only compliant response is to restrict the User-ID portal to trusted zones and disable Response Pages, which in practice means emergency change-control board approval, out-of-hours networking team deployment, and potential disruption to zero-trust remote access flows.

The indirect cost lands on insurance and procurement. Cyber insurers routinely use KEV non-compliance as a policy condition. Agencies that document non-compliance on a deadline-before-patch scenario face an ambiguous insurance posture: technically non-compliant, practically unable to comply. The resolution of that ambiguity will likely require CISA to publish explicit guidance on deadline-before-patch situations, a process that itself takes weeks.

Consensus view: CISA's Kathryn Kempf and Atlantic Council's Trey Herr both assess the deadline-before-patch scenario as an edge case the KEV programme's 2021 mandate never explicitly addressed: the Binding Operational Directive 22-01 instructs agencies to patch or remove, but has no provision for when the vendor cannot yet supply a patch.

Counter-view: The Heritage Foundation's Cyber Policy Center argues CISA should have checked vendor patch schedules before publishing the deadline, and that the failure reveals an internal co-ordination gap between CISA's KEV team and its Industrial Control Systems division, which routinely communicates patch timelines with vendors before advisories.

Key tension: Whether KEV should require vendor confirmation of patch availability before setting a federal deadline, or whether operational urgency justifies deadlines that force mitigation documentation even when no patch exists.

Sources:CISA·Palo Alto Networks PSIRT·Palo Alto Networks PSIRT

Mentions:CISA →Known Exploited Vulnerabilities →Common Vulnerability Scoring System →Atlantic Council →Cisco →Cisco Catalyst SD-WAN Manager →Microsoft →Heritage Foundation →CitrixBleed 3 →User-ID Authentication Portal →Palo Alto Networks →PAN-OS →Binding Operational Directive →

First Reported In

Update #3 · CISA's deadline outruns Palo Alto's patch

CISA· 8 May 2026

Read original →

Causes and effects

Caused by

Exchange repeats the CISA deadline-before-patch trap

The Exchange CVE-2026-42897 CISA deadline-before-patch repeats the PAN-OS CVE-2026-0300 precedent from 6 May, establishing the pattern as posture rather than exception.

Occurred 15 May 2026

Read story →

This Event

CISA deadline for PAN-OS RCE lands four days early

The deadline-before-patch gap exposes a structural assumption inside the KEV programme: that a federal compliance window can only be set after a vendor fix exists.

Led to

CISA gives Cisco SD-WAN three days to patch

CISA's deadline-before-patch for PAN-OS extends the three-day standard first applied to Cisco SD-WAN Manager, where the patch existed at KEV-add time.

Occurred 20 Apr 2026

Read story →

Trump proposes $707m CISA cut, 860 jobs

CISA enforcing a deadline the vendor cannot meet while operating under a proposed $707m budget cut exposes the structural limits of compliance-led cybersecurity with reduced agency capacity.

Occurred 7 Apr 2026

Read story →

Sixteen cyber agencies name Flax Typhoon network

CISA's tightening KEV deadline cadence applied to CVE-2026-0300 is the continuation of the multi-agency deadline-enforcement doctrine named in the sixteen-agency IOC extinction advisory.

Occurred 23 Apr 2026

Read story →

WebLogic flaw revived as ransomware vector

The PAN-OS case saw a federal deadline land before the vendor's own patch existed (ID:3122); the WebLogic deadline follows the same KEV-enforcement-ahead-of-remediation pattern, here with a 21-day window rather than negative days.

Occurred 1 Jun 2026

Read story →

Arista refuses to patch KEV flaw

PAN-OS CVE-2026-0300 deadline arriving four days before the patch shipped was the first documented KEV compliance gap; Arista's formal refusal to patch is a qualitatively worse failure of the same BOD 22-01 remediation model.

Occurred 9 Jun 2026

Read story →

CISA tears up its KEV deadline rules

CISA setting a PAN-OS KEV deadline four days before the patch shipped exposed BOD 22-01's structural flaw, contributing to the decision to replace it.

Occurred 10 Jun 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.