CVE-2026-0257
Attackers bypass authentication in Palo Alto PAN-OS firewalls to establish unauthorized VPN connections.
This authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software lets an attacker bypass security restrictions and set up an unauthorized VPN connection. It affects PAN-OS firewall software, but not Panorama or Cloud NGFW. CISA has added it to its Known Exploited Vulnerabilities list, indicating active exploitation, and US federal agencies must fix by 2026-06-01.
Palo Alto Networks PAN-OS · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 29 May; US agencies must fix by 1 June. Used by ransomware gangs
SeverityhighCVSS 7.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| PAN-OS 12.1 | 12.1.7, 12.1.4-h6 |
| Prisma Access 11.2 | 11.2.7-h13 |
| PAN-OS 11.2 | 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17 |
| PAN-OS 11.1 | 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33 |
What to do
- Apply the fixed versions provided by Palo Alto Networks: PAN-OS 12.1 update to 12.1.7 or 12.1.4-h6, PAN-OS 11.2 update to 11.2.12 or 11.2.10-h7 or 11.2.7-h14 or 11.2.4-h17, PAN-OS 11.1 update to 11.1.15 or one of the listed patch versions, PAN-OS 10.2 update to 10.2.18-h6 or one of the listed patch versions, and Prisma Access 11.2 update to 11.2.7-h13 or Prisma Access 10.2 update to 10.2.10-h36.
- If you cannot patch immediately, follow the workarounds recommended by Palo Alto Networks in their security advisory.
What happened
- 29 MayCISA adds CVE-2026-0257 to its Known Exploited Vulnerabilities list and orders US federal agencies to fix by 2026-06-01.
- 20 OctPalo Alto Networks' Unit 42 warns that multiple ransomware groups have been exploiting the vulnerability for months to gain initial access and bypass multi-factor authentication.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-0257 | PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities | high 7.8 | 29 May | 95% |
The records
security.paloaltonetworks.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-0257 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works