CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass

Exploited in the wild High 7.8 Published 13 May 2026 Updated 15 Oct 2026

Attackers can bypass authentication in PAN-OS GlobalProtect to establish unauthorized VPN connections, requiring immediate patching by network administrators.

Exploited in the wild: Since 29 May 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-0257?

CVE-2026-0257 is a high-severity authentication bypass vulnerability in Paloaltonetworks Pan-Os, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

Panorama and Cloud NGFW are not impacted by these issues.

Weakness: CWE-565

Which versions are affected by CVE-2026-0257?

It affects 3 products.

Products include Paloaltonetworks Pan-Os, Paloaltonetworks Prisma Access, Siemens Ruggedcom Ape1808 Firmware.

How do I fix CVE-2026-0257?

No fix has been published for CVE-2026-0257 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 1 Jun 2026.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-0257 being exploited?

Yes. Attackers have exploited CVE-2026-0257 in the wild since at least 29 May 2026, including in ransomware campaigns.

Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-jqxw-84hx-6qj5.