Loading story…
Attackers are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access GlobalProtect deployments to bypass authentication and gain unauthorized VPN access. The flaw affects environments where the non-default authentication override feature is enabled and the cookie encryption certificate is improperly reused with another service such as HTTPS, allowing a remote unauthenticated attacker to forge authentication override cookies. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, while Rapid7 reported exploitation beginning as early as May 17 and observed additional activity on May 21.
Rapid7 said some intrusions resulted in full VPN IP assignments and direct access to internal networks, with two of ten impacted MDR customer environments showing successful attacker VPN sessions. Investigators linked multiple waves of activity to the same threat actor based on recurring artifacts including spoofed MAC address aa:bb:cc:dd:ee:ff and hostnames such as GP-CLIENT and DESKTOP-GP01, with attack infrastructure hosted at Vultr and later Dromatics Systems. Palo Alto Networks has released patches, and defenders are being urged to upgrade immediately, disable authentication override if it is not required, use a dedicated certificate exclusively for authentication override cookies, and hunt for the published indicators of compromise.
See which actors are running it and whether you're in range.
11 events from the most recent confirmed update back to the earliest known activity.
Following CISA's addition of CVE-2026-0257 to the KEV catalog, federal civilian agencies were required to remediate the Palo Alto Networks authentication bypass vulnerability by June 19, 2026. The reference also emphasized that unsupported PAN-OS 9.0, 9.1, and 10.0 versions remain vulnerable and will not receive fixes.
Palo Alto Networks Unit 42 warned that an unidentified threat actor was probing GlobalProtect-enabled devices at scale for CVE-2026-0257, with only a small subset of targets resulting in successful gateway-connected events. The company also published network and host-based indicators and said no confirmed lateral movement or data exfiltration had been observed.
FortiGuard Labs reported that exploitation of Palo Alto Networks GlobalProtect authentication bypass CVE-2026-0257 was still ongoing against exposed services as of June 9, 2026. The alert reiterated that attackers could establish unauthorized VPN sessions and conduct follow-on activity inside victim networks.
Arctic Wolf reported that exploitation of Palo Alto Networks GlobalProtect authentication bypass CVE-2026-0257 increased sharply from May 30, 2026, following public release of technical details and proof-of-concept code. In some intrusions, attackers established unauthorized IPSec tunnels and performed internal SMB and NTLM reconnaissance after gaining VPN access.
Bishop Fox published analysis showing how CVE-2026-22557 could be used to steal UniFi controller backups, databases, and TLS keystores, potentially leading to controller takeover and compromise of managed devices. The firm also released a safe detection tool and highlighted patched UniFi versions.
Rapid7 publicly reported active exploitation of CVE-2026-0257, confirmed the issue with a proof of concept, and published a testing script. The company said attackers obtained VPN sessions in 2 of 10 impacted MDR customer environments, though no lateral movement was observed.
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026. The listing reflected active in-the-wild exploitation of the Palo Alto Networks authentication bypass flaw.
Additional exploitation activity was observed on May 21, 2026, against vulnerable GlobalProtect deployments. Reporting linked both waves to the same threat actor based on consistent artifacts such as a spoofed MAC address and recurring hostnames.
Rapid7 observed exploitation of Palo Alto Networks PAN-OS/Prisma Access GlobalProtect authentication bypass CVE-2026-0257 beginning as early as May 17, 2026. The activity targeted deployments with authentication override enabled and a reused cookie-encryption certificate.
Palo Alto Networks released fixes for CVE-2026-0257 on May 13, 2026. The authentication bypass flaw affects PAN-OS GlobalProtect portal and gateway deployments under specific configurations involving authentication override cookies and certificate reuse.
Ubiquiti disclosed CVE-2026-22557 on March 18, 2026, as part of security bulletin SAB-062. The flaw affects the UniFi Network Application guest captive portal and was later described by Bishop Fox as an unauthenticated path traversal issue.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
23 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcecisecurity.org
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcethecyberthrone.in
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **CVE-2026-0257**, an authentication bypass flaw in **PAN-OS GlobalProtect portal and gateway** that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while **Cloud NGFW** and **Panorama** were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override. Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to **Vultr** and **Dromatics Systems**. **CISA** added `CVE-2026-0257` to its **Known Exploited Vulnerabilities** catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including **OT/SCADA** networks. A separate Palo Alto advisory released alongside it also addressed **CVE-2026-0262**, a PAN-OS network traffic parsing denial-of-service issue.
Aug 31, 2026
Palo Alto Networks released fixes for **CVE-2026-0227**, a high-severity denial-of-service vulnerability in **PAN-OS** that can be triggered by an **unauthenticated** attacker when the **GlobalProtect gateway or portal** is enabled on affected next-generation firewall and *Prisma Access* configurations. Repeated exploitation attempts can force impacted firewalls into **maintenance mode**, effectively disabling protections and causing service disruption; Palo Alto Networks stated there are **no workarounds** and advised upgrading to patched releases. Reporting indicates a **proof-of-concept (PoC)** exploit exists, although Palo Alto Networks said it had **no evidence of in-the-wild exploitation** at the time of advisory publication. Exposure risk remains material given the large number of internet-facing Palo Alto Networks firewalls observed online (with Shadowserver tracking roughly **6,000** exposed devices) and ongoing scanning activity historically targeting exposed GlobalProtect endpoints; administrators should prioritize patching across affected PAN-OS and Prisma Access versions and validate whether GlobalProtect is enabled on externally reachable interfaces.
Jun 29, 2026
Palo Alto Networks disclosed and patched **`CVE-2024-3400`**, a critical **CVSS 10.0** flaw in **PAN-OS** that allows unauthenticated attackers to achieve remote code execution through an arbitrary file creation issue leading to OS command injection. The vulnerability affects **PAN-OS 10.2, 11.0, and 11.1** when **GlobalProtect Gateway or Portal** is enabled, while **Cloud NGFW, Panorama appliances, and Prisma Access** are not affected. Volexity reported active in-the-wild exploitation, prompting Palo Alto to release hotfixes and Threat Prevention signatures **`95187`**, **`95189`**, and **`95191`** and to urge immediate upgrades. Post-compromise activity tracked by Unit 42 as **Operation MidnightEclipse** showed attackers gaining root-level execution on exposed firewalls, attempting limited data exfiltration, and establishing persistence. Researchers said the actor tried to deploy a custom Python backdoor called **UPSTYLE** and, when that failed, installed a cron-job backdoor instead. Updated guidance also clarified that disabling device telemetry is **not** an effective mitigation, and defenders were advised to patch immediately, enable threat prevention protections, and hunt for published indicators of compromise including malicious IPs, domains, URLs, and file hashes.
Aug 15, 2026