Palo Alto PAN-OS Authentication Bypass Exposes CAS-Enabled Firewalls and Panorama

Palo Alto Networks released security advisories for multiple PAN-OS branches after disclosing several serious flaws, including CVE-2026-0265, an authentication bypass caused by a signature verification weakness when Cloud Authentication Service (CAS) is enabled and attached to a login interface. The issue affects PA-Series, VM-Series, and Panorama deployments, while Cloud NGFW and Prisma Access are not affected. Palo Alto also warned of a heap-based buffer overflow in the DNS Proxy and DNS Server that could enable unauthenticated remote code execution, as well as a separate remote code execution flaw in IKEv2 processing across supported releases including 12.1, 11.2, 11.1, and 10.2.

The Canadian Centre for Cyber Security urged administrators to review Palo Alto’s advisories, apply mitigations, and install updates, with fixes already issued for many affected versions and additional patches expected for some branches. Rapid7 said organizations using CAS should prioritize emergency patching rather than depend on workarounds, while researcher Harsh Jaiswal of HacktronAI publicly claimed successful exploitation of the authentication bypass against multiple companies’ GlobalProtect portals to obtain VPN access; Palo Alto had not confirmed in-the-wild exploitation as of May 14.