CVE-2026-0257: Palo Alto PAN-OS GlobalProtect authentication bypass, actively exploited
The short version: CVE-2026-0257 is an authentication-bypass flaw in the GlobalProtect portal and gateway of PAN-OS. An attacker can bypass security restrictions and establish an unauthorized VPN connection — a foothold onto the network the VPN is meant to protect. Palo Alto has observed limited exploitation of unpatched devices, and it's in CISA's KEV catalog. Panorama and Cloud NGFW aren't affected. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice (see below) |
| CVSS v3.1 (NVD) | 9.1 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CVSS (Palo Alto) | 7.8 — High |
| EPSS | ~86.68% · 99.72nd percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2026-06-01 |
| Known exploited? | Yes — limited exploit attempts observed on unpatched devices |
| Vulnerability type | CWE-565 reliance on cookies without validation → authentication bypass → unauthorized VPN connection |
| Requires authenticated session? | No — pre-authentication |
| Affected | PAN-OS GlobalProtect on 10.2, 11.1, 11.2, and 12.1 branches — see Palo Alto's advisory for exact fixed hotfix builds |
| Fixed in | See Palo Alto's advisory (e.g. 10.2.7-h34 · 11.1.4-h33 · 11.2.4-h17 · 12.1.4-h6 / 12.1.7, and later per branch) |
| Not affected | Panorama and Cloud NGFW |
What you need to know
GlobalProtect is the PAN-OS VPN feature; its portal and gateway are meant to be internet-facing so remote users can connect. CVE-2026-0257 lets an attacker bypass authentication — the root cause is reliance on cookies without proper validation and integrity checking — and stand up an unauthorized VPN connection without valid credentials.
Why prioritize it:
- It's pre-authentication and internet-reachable by design. GlobalProtect portals are exposed so users can reach them, which means attackers can too.
- A VPN connection is a network foothold. Bypassing the gate puts an attacker inside the network perimeter the VPN is supposed to defend.
- It's confirmed exploited. Palo Alto has observed limited in-the-wild attempts, and CISA added it to KEV with a firm deadline.
How serious we see it
Critical — in practice.
NVD scores it 9.1; Palo Alto rates it 7.8. We land at High: it's unauthenticated, internet-facing, KEV-listed, and confirmed exploited — but the direct impact is an unauthorized VPN session (network access), not immediate administrator or root control of the appliance. That's a serious foothold worth treating urgently, and the bounded, reassuring part holds: it affects specific PAN-OS builds, Panorama and Cloud NGFW aren't affected, and fixes are published per branch.
Recommendations
Straight from Palo Alto's advisory and CISA:
- Patch now. Upgrade to the fixed PAN-OS build for your branch (see Palo Alto's advisory for exact hotfix versions).
- Limit exposure where you can. Restrict who can reach the GlobalProtect portal/gateway, and apply Palo Alto's recommended mitigations if you can't patch immediately.
- Hunt. Review VPN and authentication logs for unexpected or unauthorized GlobalProtect sessions.
- If compromised, respond. Investigate for network access beyond the VPN and rotate affected credentials.
- Confirm your exposure first. Verify whether you run an affected PAN-OS build with GlobalProtect enabled.
How BreachRisk sees it
BreachRisk discovers internet-facing GlobalProtect portals from little more than your domain, fingerprints the PAN-OS product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top because it's in KEV.
That continuous, outside-in view is the point: when a VPN auth-bypass breaks, the exposed portal is already mapped, so you can go straight to patch-and-verify instead of hunting for what you own.