Palo Alto Warns of Active Exploitation of PAN-OS Global Protect VPN Flaw
Summary: Palo Alto Networks reported active exploitation of CVE-2026-0257, a CVSS 7.8 authentication bypass in the portal and gateway components of PAN-OS that lets an attacker bypass security controls and establish GlobalProtect VPN connections. The company said the limited in-the-wild attacks began May 17, 2026, the actor is unknown, and only a small portion of probed devices actually established VPN sessions, with no post-access behavior or lateral movement identified so far.
What's compelling: An authentication bypass on a VPN gateway is a path straight into the network, and the actor behind this one has not been identified. CISA's addition of CVE-2026-0257 to the KEV catalog with a June 1, 2026 federal mitigation deadline signals the flaw is being used, not merely disclosed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-0257
- Related
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) Cyber Risks · Oct 20, 2026CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 29, 2026