THREAT actors are actively targeting a high-severity authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS just four days after its public disclosure. The vulnerability allows attackers to bypass VPN restrictions, and Palo Alto released patches on May 13. As of May 17, exploit attempts have been observed. The U.S. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, urging immediate patching.
Rapid7 indicated that attackers exploited flaws starting May 17 and provided a proof-of-concept script to help organizations identify vulnerabilities. Users are advised to update to patched versions of PAN-OS.