{"id":1103,"date":"2026-05-30T08:24:54","date_gmt":"2026-05-30T08:24:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1103"},"modified":"2026-05-30T08:24:54","modified_gmt":"2026-05-30T08:24:54","slug":"pan-os-globalprotect-authentication-bypass-cve-2026-0257-under-active-exploitation","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1103","title":{"rendered":"PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 30, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild.<\/p>\n

The vulnerability, tracked as CVE-2026-0257<\/a><\/b> (CVSS score: 7.8), refers to a case of authentication bypass that could be exploited by bad actors to set up VPN connections.<\/p>\n

\u00abAuthentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS\u00ae software allow the attacker to bypass security restrictions and establish an unauthorized VPN connection,\u00bb Palo Alto Networks said in an advisory released on May 13, 2026.<\/p>\n

The issue specifically affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists, the network security company said.<\/p>\n

In an update to its advisory on May 29, 2026, Palo Alto Networks said it has \u00abbecome aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The development comes after Rapid7 revealed<\/a> it identified successful exploitation across numerous customers, with the earliest efforts dating back to May 17, 2026, followed by a second wave on May 21. Both the exploitation sets are assessed to be the work of the same threat actor.<\/p>\n

The activity observed in the second wave involved VPN IP assignment following the cookie authentication in two cases, granting the attacker access to the internal network. No follow-on activity in the customer environments where a VPN session was established, the cybersecurity vendor added.<\/p>\n

\u00abAn authentication bypass in an edge facing enterprise VPN appliance can have significant impact to affected organizations,\u00bb Rapid7 said. \u00abAs such, organizations running affected appliances are urged to upgrade to a vendor supplied patch on an urgent basis.\u00bb<\/p>\n

As temporary mitigations, it’s recommended to either disable the authentication override feature or generate a new certificate to use exclusively for the authentication override feature.<\/p>\n

The exploitation of CVE-2026-0257 follows a report from Arctic Wolf about the continued weaponization of a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments (CVE-2026-35616, CVSS score: 9.1) to deliver credential-stealing malware called EKZ Infostealer.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802May 30, 2026Vulnerability \/ Network Security Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in…<\/p>\n","protected":false},"author":1,"featured_media":1104,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[64,396,394,1846,65,1845,1537],"class_list":["post-1103","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-active","tag-authentication","tag-bypass","tag-cve20260257","tag-exploitation","tag-globalprotect","tag-panos"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1103"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1103\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1104"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}