Loading story…
Palo Alto Networks disclosed CVE-2026-0257, an authentication bypass flaw in PAN-OS GlobalProtect portal and gateway that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while Cloud NGFW and Panorama were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override.
Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to Vultr and Dromatics Systems. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including OT/SCADA networks. A separate Palo Alto advisory released alongside it also addressed CVE-2026-0262, a PAN-OS network traffic parsing denial-of-service issue.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CSIRT Panamá issued an alert warning of active exploitation of CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway deployments. The notice described the authentication bypass mechanism and the risk of unauthorized VPN access to internal networks.
Rapid7 reported successful exploitation of CVE-2026-0257 against multiple customers beginning May 17, 2026. The attacks used infrastructure from Vultr and Dromatics Systems to target unpatched PAN-OS GlobalProtect deployments.
Palo Alto Networks published product advisories for CVE-2026-0257, a GlobalProtect authentication bypass vulnerability, and CVE-2026-0262, a PAN-OS denial-of-service issue. The advisories documented the vulnerabilities and associated remediation information.
The Dutch NCSC warned that CVE-2026-0257 is actively exploited and said exploitation requires reused HTTPS certificates plus an enabled authentication-override cookie setting. It advised prompt installation of Palo Alto updates and use of Rapid7 indicators of compromise; it also noted that public proof-of-concept code is available.
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The listing reflected the vulnerability's status as an exploited authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect.
Palo Alto Networks reported limited exploitation attempts against unpatched PAN-OS devices without mitigations during May 2026. The activity involved attempts to abuse the GlobalProtect authentication bypass flaw CVE-2026-0257.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
cert.pa
Open sourcencsc.nl
Open sourcesecurity.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourcecve.circl.lu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-0257** in Palo Alto Networks **PAN-OS** and **Prisma Access GlobalProtect** deployments to bypass authentication and gain unauthorized VPN access. The flaw affects environments where the non-default authentication override feature is enabled and the cookie encryption certificate is improperly reused with another service such as HTTPS, allowing a remote unauthenticated attacker to forge authentication override cookies. **CISA** added the vulnerability to its **Known Exploited Vulnerabilities** catalog, while Rapid7 reported exploitation beginning as early as May 17 and observed additional activity on May 21. Rapid7 said some intrusions resulted in full VPN IP assignments and direct access to internal networks, with two of ten impacted MDR customer environments showing successful attacker VPN sessions. Investigators linked multiple waves of activity to the same threat actor based on recurring artifacts including spoofed MAC address `aa:bb:cc:dd:ee:ff` and hostnames such as `GP-CLIENT` and `DESKTOP-GP01`, with attack infrastructure hosted at Vultr and later Dromatics Systems. Palo Alto Networks has released patches, and defenders are being urged to upgrade immediately, disable authentication override if it is not required, use a dedicated certificate exclusively for authentication override cookies, and hunt for the published indicators of compromise.
Jul 21, 2026
Palo Alto Networks released security advisories for multiple **PAN-OS** branches after disclosing several serious flaws, including `CVE-2026-0265`, an authentication bypass caused by a signature verification weakness when **Cloud Authentication Service (CAS)** is enabled and attached to a login interface. The issue affects **PA-Series**, **VM-Series**, and **Panorama** deployments, while **Cloud NGFW** and **Prisma Access** are not affected. Palo Alto also warned of a heap-based buffer overflow in the DNS Proxy and DNS Server that could enable unauthenticated remote code execution, as well as a separate remote code execution flaw in **IKEv2** processing across supported releases including 12.1, 11.2, 11.1, and 10.2. The Canadian Centre for Cyber Security urged administrators to review Palo Alto’s advisories, apply mitigations, and install updates, with fixes already issued for many affected versions and additional patches expected for some branches. Rapid7 said organizations using CAS should prioritize emergency patching rather than depend on workarounds, while researcher Harsh Jaiswal of HacktronAI publicly claimed successful exploitation of the authentication bypass against multiple companies’ **GlobalProtect** portals to obtain VPN access; Palo Alto had not confirmed in-the-wild exploitation as of May 14.
Jul 23, 2026
Palo Alto Networks released fixes for **CVE-2026-0227**, a high-severity denial-of-service vulnerability in **PAN-OS** that can be triggered by an **unauthenticated** attacker when the **GlobalProtect gateway or portal** is enabled on affected next-generation firewall and *Prisma Access* configurations. Repeated exploitation attempts can force impacted firewalls into **maintenance mode**, effectively disabling protections and causing service disruption; Palo Alto Networks stated there are **no workarounds** and advised upgrading to patched releases. Reporting indicates a **proof-of-concept (PoC)** exploit exists, although Palo Alto Networks said it had **no evidence of in-the-wild exploitation** at the time of advisory publication. Exposure risk remains material given the large number of internet-facing Palo Alto Networks firewalls observed online (with Shadowserver tracking roughly **6,000** exposed devices) and ongoing scanning activity historically targeting exposed GlobalProtect endpoints; administrators should prioritize patching across affected PAN-OS and Prisma Access versions and validate whether GlobalProtect is enabled on externally reachable interfaces.
Jun 29, 2026