VULNERABILITY 🔴 1×KEV
CVE-2026-0257 in Palo Alto Networks PAN-OS: Actively Exploited Authentication Bypass Added to CISA KEV
- An authentication bypass vulnerability, CVE-2026-0257, affects the GlobalProtect feature in Palo Alto Networks PAN-OS.
- CONFIRMED active exploitation in the wild has led to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog.
- Immediate investigation of exposed assets for signs of compromise is required. Patching should be prioritized as soon as a fix is released by the vendor.
Technical Analysis
CVE-2026-0257 is an authentication bypass vulnerability within the GlobalProtect VPN functionality of Palo Alto Networks' PAN-OS. The specific technical mechanism of the flaw has not been detailed in the available intelligence. However, the vulnerability class implies that an unauthenticated, remote attacker can circumvent authentication controls on an exposed GlobalProtect interface.
A successful exploit would likely grant the attacker access to the internal network resources that the VPN is configured to protect. This represents a critical failure of a primary network security boundary, allowing an external threat actor to establish an initial foothold within the target environment without credentials.
Affected Systems
- PAN-OS (GlobalProtect feature)
Intelligence Context
The addition of CVE-2026-0257 to the CISA KEV catalog is the primary driver for prioritization. This serves as CONFIRMED evidence of in-the-wild exploitation. The high EPSS score of 0.41505 further substantiates the immediate risk, predicting a greater than 40% chance of exploitation activity within the next 30 days. The 'ZERO-DAY RACE' label indicates that attackers began exploiting the vulnerability before or concurrently with its public disclosure, leaving defenders with no time to prepare. Despite the lack of a CVSS score and a low vendor risk score, the combination of KEV status and active exploitation makes this a critical threat requiring immediate attention.
Remediation & Defense
- No specific workarounds have been provided. Consider restricting access to the GlobalProtect interface to trusted IP addresses if operationally feasible, pending a patch.
- Monitor firewall and VPN logs for anomalous authentication patterns, such as successful logins without corresponding authentication attempts or connections from unexpected geographic locations.
- Investigate for any unauthorized user accounts or unexpected internal network activity originating from the VPN user subnet.
Source Timeline
- thehackernews.com — First reporter
- bleepingcomputer.com — Corroborating source
- cisa.gov/known-exploited-vulnerabilities-catalog — Official exploitation confirmation