PAN-OS Global Protect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
Summary: Palo Alto Networks warned that CVE-2026-0257, a CVSS 7.8 authentication bypass in the GlobalProtect portal and gateway of PAN-OS and Prisma Access, is under active exploitation, affecting firewalls where authentication override cookies are enabled and a specific certificate configuration exists. Rapid7 reported successful exploitation across numerous customers, with the earliest attempts on May 17, 2026 and a second wave on May 21 that in two cases assigned VPN IPs and gave the attacker access to the internal network.
Key Takeaway: A medium-severity rating did not stop attackers from turning this into internal network access at multiple organizations, and CISA's KEV listing gives federal agencies until June 1, 2026 to mitigate - a deadline your own patching cadence should be measured against.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2026-0257CVE-2026-35616
- Related
- ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More Cyber Risks ·Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) Cyber Risks · Oct 20, 2026CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 29, 2026