Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Attackers Leverage CVE-2026-0257 to Bypass GlobalProtect VPN Auth

Part of the CVE-2026-0257 story · since 29 May

Quiet for 10 dayslast report 23 Oct27 articles10 outlets
29 May · Rapid7 first17 Aug13 Sep10 OctNowThis article17th of 27
  • Fri 29 May, 19:30 UTC. Rapid7, first report. Rapid7 flags active CVE-2026-0257 exploits in PAN-OS GlobalProtect. Cites a CVE in CISA KEV.
  • Fri 29 May, 19:50 UTC. CISA, its first report on the story. CISA Flags Palo Alto PAN OS Auth Bypass After Active Exploitation. Cites a CVE in CISA KEV.
  • Fri 29 May, 20:40 UTC. CISA. CISA Adds Palo Alto PAN OS Auth Bypass CVE-2026-0257 to KEV List. Cites a CVE in CISA KEV.
  • Fri 29 May, 21:52 UTC. CISA. CISA KEV Catalog flags Palo Alto PAN-OS auth bypass flaw. Cites a CVE in CISA KEV.
  • Sat 30 May, 03:32 UTC. SecurityOnline, its first report on the story. Critical PANOS Flaw Lets Attackers Bypass Authentication. Cites a CVE in CISA KEV.
  • Sat 30 May, 07:41 UTC. The Hacker News, its first report on the story. PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation. Cites a CVE in CISA KEV.
  • Sun 31 May, 16:41 UTC. SecurityOnline. CVE-2026-0257 flaw in MCP Toolbox allows site based session hijack. Cites a CVE in CISA KEV.
  • Sun 31 May, 18:26 UTC. Security Affairs, its first report on the story. CVE-2026-0257 flaw lets attackers hijack Palo Alto VPN logins. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 02:48 UTC. SecurityOnline. Critical Langroid Vulnerability Allows RCE via Prompt Injection. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 02:52 UTC. SecurityOnline. Critical FreeBSD Kernel Buffer Overflow Disclosed: Public Details & PoC Out. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 08:31 UTC. Infosecurity, its first report on the story. Attackers Exploit CVE-2026-0257 in Palo Alto GlobalProtect VPN. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 09:41 UTC. Security Affairs. CISA flags PAN-OS flaw CVE-2026-0257 as attackers bypass VPN auth. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 10:18 UTC. SecurityWeek, its first report on the story. Palo Alto PANOS flaw exploited days after patch release. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 12:02 UTC. SecurityOnline. CVE-2026-0257 Cache Warmer RCE Bug Hits. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 15:21 UTC. Dark Reading, its first report on the story. CVE-2026-0257 flaw lets hackers bypass Palo Alto VPN auth. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 14:41 UTC. Unit 42, its first report on the story. Attackers Exploit PANOS Flaw to Bypass GlobalProtect VPN. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 11:59 UTC. Security Affairs. Attackers Leverage CVE-2026-0257 to Bypass GlobalProtect VPN Auth. Cites a CVE in CISA KEV. This article, 17th of 27.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 12:36 UTC. SecurityOnline. Hackers Exploited GlobalProtect Flaw to Fuel Brazilian Invoice Fraud. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 19:26 UTC. The Hacker News. Attackers Exploit PAN-OS Flaw to Gain VPN Access and Move Laterally. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches, its first report on the story. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 02:08 UTC. SecurityOnline. Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 15:00 UTC. The Hacker News. Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign. Cites a CVE in CISA KEV.

Palo Alto Networks has issued a warning regarding an active exploitation of CVE-2026-0257, a vulnerability in PAN-OS that allows unauthorized users to bypass authentication and establish VPN connections. The flaw affects GlobalProtect portals and gateways but does not impact Panorama or Cloud NGFW deployments. Rapid7 confirmed exploitation across multiple customer environments soon after the vulnerability was disclosed.

Attackers can forge cookies using a misconfiguration in the authentication process, gaining access without credentials. The exploit was observed in two waves originating from specific infrastructures. Palo Alto and Rapid7 recommend patching affected systems or implementing configuration changes to mitigate the risk. Organizations are advised to scrutinize logins for certain IP addresses and hostnames associated with the exploit.

How the story developed

All 27 articles
Quiet for 10 dayslast report 23 Oct27 articles10 outlets

27 articles from 10 outlets since 29 May. Quiet since 23 Oct. This was the 17th report, 17 days after the first.

Now29 May111620 Jul28 Sep6111621First reportRapid7 · 29 May, 19:30This article17th of 27 · day 17
  • Fri 29 May, 19:30 UTC. Rapid7, first report. Rapid7 flags active CVE-2026-0257 exploits in PAN-OS GlobalProtect. Cites a CVE in CISA KEV.
  • Fri 29 May, 19:50 UTC. CISA, its first report on the story. CISA Flags Palo Alto PAN OS Auth Bypass After Active Exploitation. Cites a CVE in CISA KEV.
  • Fri 29 May, 20:40 UTC. CISA. CISA Adds Palo Alto PAN OS Auth Bypass CVE-2026-0257 to KEV List. Cites a CVE in CISA KEV.
  • Fri 29 May, 21:52 UTC. CISA. CISA KEV Catalog flags Palo Alto PAN-OS auth bypass flaw. Cites a CVE in CISA KEV.
  • Sat 30 May, 03:32 UTC. SecurityOnline, its first report on the story. Critical PANOS Flaw Lets Attackers Bypass Authentication. Cites a CVE in CISA KEV.
  • Sat 30 May, 07:41 UTC. The Hacker News, its first report on the story. PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation. Cites a CVE in CISA KEV.
  • Sun 31 May, 16:41 UTC. SecurityOnline. CVE-2026-0257 flaw in MCP Toolbox allows site based session hijack. Cites a CVE in CISA KEV.
  • Sun 31 May, 18:26 UTC. Security Affairs, its first report on the story. CVE-2026-0257 flaw lets attackers hijack Palo Alto VPN logins. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 02:48 UTC. SecurityOnline. Critical Langroid Vulnerability Allows RCE via Prompt Injection. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 02:52 UTC. SecurityOnline. Critical FreeBSD Kernel Buffer Overflow Disclosed: Public Details & PoC Out. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 08:31 UTC. Infosecurity, its first report on the story. Attackers Exploit CVE-2026-0257 in Palo Alto GlobalProtect VPN. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 09:41 UTC. Security Affairs. CISA flags PAN-OS flaw CVE-2026-0257 as attackers bypass VPN auth. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 10:18 UTC. SecurityWeek, its first report on the story. Palo Alto PANOS flaw exploited days after patch release. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 12:02 UTC. SecurityOnline. CVE-2026-0257 Cache Warmer RCE Bug Hits. Cites a CVE in CISA KEV.
  • Mon 1 Jun, 15:21 UTC. Dark Reading, its first report on the story. CVE-2026-0257 flaw lets hackers bypass Palo Alto VPN auth. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 14:41 UTC. Unit 42, its first report on the story. Attackers Exploit PANOS Flaw to Bypass GlobalProtect VPN. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 11:59 UTC. Security Affairs. Attackers Leverage CVE-2026-0257 to Bypass GlobalProtect VPN Auth. Cites a CVE in CISA KEV. This article, 17th of 27.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 12:36 UTC. SecurityOnline. Hackers Exploited GlobalProtect Flaw to Fuel Brazilian Invoice Fraud. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Thu 15 Oct, 19:26 UTC. The Hacker News. Attackers Exploit PAN-OS Flaw to Gain VPN Access and Move Laterally. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches, its first report on the story. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 02:08 UTC. SecurityOnline. Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 15:00 UTC. The Hacker News. Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 27 articles as a list
  1. Fri 29 MayDay 04
    1. Rapid7 flags active CVE-2026-0257 exploits in PAN-OS GlobalProtect19:30 · Rapid7 · First report · Known exploited CVE
    2. CISA Flags Palo Alto PAN OS Auth Bypass After Active Exploitation19:50 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Palo Alto PAN OS Auth Bypass CVE-2026-0257 to KEV List20:40 · CISA · official · Known exploited CVE
    4. CISA KEV Catalog flags Palo Alto PAN-OS auth bypass flaw21:52 · CISA · official · Known exploited CVE
  2. Sat 30 MayDay 12
    1. Critical PANOS Flaw Lets Attackers Bypass Authentication03:32 · SecurityOnline · Known exploited CVE
    2. PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation07:41 · The Hacker News · Known exploited CVE
  3. Sun 31 MayDay 22
    1. CVE-2026-0257 flaw in MCP Toolbox allows site based session hijack16:41 · SecurityOnline · Known exploited CVE
    2. CVE-2026-0257 flaw lets attackers hijack Palo Alto VPN logins18:26 · Security Affairs · Known exploited CVE
  4. Mon 1 JunDay 37
    1. Critical Langroid Vulnerability Allows RCE via Prompt Injection02:48 · SecurityOnline · Known exploited CVE
    2. Critical FreeBSD Kernel Buffer Overflow Disclosed: Public Details & PoC Out02:52 · SecurityOnline · Known exploited CVE
    3. Attackers Exploit CVE-2026-0257 in Palo Alto GlobalProtect VPN08:31 · Infosecurity · Known exploited CVE
    Show 4 more from 1 Jun
    1. CISA flags PAN-OS flaw CVE-2026-0257 as attackers bypass VPN auth09:41 · Security Affairs · Known exploited CVE
    2. Palo Alto PANOS flaw exploited days after patch release10:18 · SecurityWeek · Known exploited CVE
    3. CVE-2026-0257 Cache Warmer RCE Bug Hits12:02 · SecurityOnline · Known exploited CVE
    4. CVE-2026-0257 flaw lets hackers bypass Palo Alto VPN auth15:21 · Dark Reading · Known exploited CVE

  5. Quiet for 4 days

    Fri 5 JunDay 71
    1. Attackers Exploit PANOS Flaw to Bypass GlobalProtect VPN14:41 · Unit 42 · Picked up again · Known exploited CVE

  6. Quiet for 10 days

    Mon 15 JunDay 171
    1. Attackers Leverage CVE-2026-0257 to Bypass GlobalProtect VPN Auth11:59 · Security Affairs · Picked up again · Known exploited CVE · This article, 17th of 27

  7. Quiet for 5 weeks

    Tue 21 JulDay 532
    1. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall03:32 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN17:01 · Security Affairs · Known exploited CVE

  8. Quiet for 10 weeks

    Tue 29 SepDay 1231
    1. Hackers Exploited GlobalProtect Flaw to Fuel Brazilian Invoice Fraud12:36 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 13 days

    Mon 12 OctDay 1361
    1. Ransomware gangs exploit Palo Alto VPN flaw months after patch release09:46 · Infosecurity · Picked up again · Known exploited CVE

  10. Quiet for 3 days

    Thu 15 OctDay 1391
    1. Attackers Exploit PAN-OS Flaw to Gain VPN Access and Move Laterally19:26 · The Hacker News · Picked up again · Known exploited CVE

  11. Quiet for 5 days

    Tue 20 OctDay 1443
    1. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-025710:43 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA16:13 · The Hacker News · Known exploited CVE
    3. Ransomware gangs exploit patched Palo Alto VPN security flaw16:48 · DataBreaches · Known exploited CVE

  12. Quiet for 2 days

    Fri 23 OctDay 1472
    1. Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks02:08 · SecurityOnline · Picked up again · Known exploited CVE
    2. Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign15:00 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in