CVE-2026-0257Active Exploitation(paloaltonetworks / pan-os)

🚨 Hackers found a way into Palo Alto’s GlobalProtect VPN without a password. The flaw, tracked as CVE-2026-0257, lets attackers bypass PAN-OS authentication and establish unauthorized VPN sessions. Palo Alto says it’s already being used in real attacks. If you run GlobalProtect, check this now. Details ➝ https://thehackernews.com/2026/06/palo-alto-warns-of-active-exploitation.html

CVE-2020-2033, CVE-2020-2021, CVE-2020-2050, CVE-2026-0257, and now CVE-2026-0265 Authentication bypass, as in direct access to your internal networks over the Internet This VPN architecture should be dead, get it off the Internet, it's a time bomb waiting to happen

🚨 CVE-2026-0257- Palo Alto Networks PAN-OS - Authentication Bypass 🔍 Nuclei Template: https://cloud.projectdiscovery.io/library/CVE-2026-0257 📑 Reference: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/ #kev #authbypass #bugbounty https://t.co/GGXI5iEZvo

Palo Alto Networks says attackers are actively exploiting a GlobalProtect VPN vulnerability known as CVE-2026-0257. The bug affects certain GlobalProtect portal and gateway setups and lets attackers connect to a VPN without the usual login and authentication checks. Since GlobalProtect is typically exposed to the internet, a successful attack could give cybercriminals access to an organization’s internal network. Security researchers have already observed real-world attacks targeting vulnerable systems. If your organization uses GlobalProtect, check whether you are affected and install the latest security updates. Palo Alto Networks has released fixes for supported PAN-OS versions and urges customers to update as soon as possible. Security teams should also monitor VPN logs and investigate any unusual login activity or unexpected VPN connections.

🚨 Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild Source: https://cybersecuritynews.com/palo-alto-vpn-vulnerability-exploited/ Palo Alto Networks Unit 42 has issued an urgent warning about active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software. The flaw allows unauthenticated remote attackers to circumvent security controls and initiate unauthorized VPN connections without requiring any credentials. Organizations are urged to immediately hunt for indicators of compromise (IOCs) in their GlobalProtect logs and activate incident response protocols for any successful gateway-connected events tied to the listed indicators. #cybersecuritynews

❗️❗️Threat actors are actively exploiting a critical authentication bypass flaw in Palo Alto Networks firewalls to breach corporate networks and deploy Qilin ransomware. Full Story: https://cybersecuritynews.com/cve-2026-0257-qilin-ransomware/ The flaw, tracked as CVE-2026-0257 (CVSS 7.8), affects the GlobalProtect portal and gateway in PAN-OS. It becomes exploitable when authentication override cookies are enabled alongside specific certificate configurations, allowing unauthenticated attackers to bypass login controls entirely and establish legitimate-looking VPN sessions. #cybersecuritynews

🚨 CVE-2026-0257, a PAN-OS and Prisma Access authentication bypass flaw, is under active exploitation. The CVSS 7.8 bug can enable unauthorized VPN access and, in some observed cases, access to internal networks. Patch immediately or apply mitigations. Details: https://thehackernews.com/2026/05/pan-os-globalprotect-authentication.html

🚨 Palo Alto Networks PAN-OS Authentication Vulnerability Bypass Exploited in the Wild Source: https://cybersecuritynews.com/palo-alto-vulnerability-exploited/ Palo Alto Networks authentication bypass vulnerability, CVE-2026-0257, affecting PAN-OS and Prisma Access, is now being actively exploited in the wild, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. The vulnerability exists in a non-default feature called "authentication override," which allows GlobalProtect portals and gateways to issue session cookies to authenticated users similar to a bearer token, so users don't need to re-authenticate each session. The flaw is triggered only when the certificate used to encrypt and decrypt these authentication override cookies is shared with another feature, such as the HTTPS service of the portal or gateway. #cybersecuritynews #vulnerability

🚨 Attackers are exploiting Palo Alto Networks PAN-OS flaw CVE-2026-0257 to deploy Qilin ransomware. Some intrusions ended in rapid encryption. Others escalated to credential theft, data exfiltration, and double extortion. How the attacks unfolded: https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html

New @rapid7 observed exploitation of PAN-OS GlobalProtect auth bypass vulnerability CVE-2026-0257 which allows authentication bypass cookies to be forged for VPN access. Full details, technical analysis, PoC , IOCs and remediation guidance in the blog: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

CVE-2026-0257、公表当初はCVSS4.7だけど実害観測が出て後から7.8に引き上がったのか。機器の詳細設定を把握している人がCVEの内容まで精査していたら気付けたかもしれないとはいえ、デジ庁のがこれだとしたら担当者を責めるのは酷な気がするな。

🚨 Based on @rapid7 observations of exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257), we can also confirm first signs of exploitation around the same time (May 18th on the Defused TF feeds, and a customer hit on May 17th) The exploit payload differs slightly from Rapid 7's POC with the user-agent PAN GlobalProtect/6.0.0 Attacker IP: 104.207.144[.]154 🇺🇸 AS20473 The Constant Company Rapid7 write-up: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

SuicaのICチップが狙われ、自宅のIoT機器が不正送金の踏み台にされ、AIが攻撃者の武器になった。 VPNは突破され、1354万件の記録が紛失した。 今日の8件は、どれもひとごとではない。 ・FeliCa ICチップCVE-2026-59776、Suica・PASMO読み取り改ざんの恐れ ・家庭用IoT数万台が不正送金事件の踏み台に、NICT・総務省・警察庁が公表 ・GlobalProtect VPN CVE-2026-0257、Qilinランサムがネットワーク侵入に積極悪用 ・九州電力送配電SSD紛失、顧客情報最大1354万件の漏洩懸念 ・ServiceNow CVE-2026-6875、未認証RCEが公開数日で野外悪用 ・Hugging Face CEO警告、攻撃者はすでにAIエージェントを実攻撃に使っている ・DrupalのAIプラグインにCVSS7.1の認証不備、アカウント乗っ取りの恐れ ・MetaサポートAPIの認証不備、顧客情報アクセス可能で78,000ドルのバウンティ 今日の8件に共通する入り口は、普通の機器と普通の設定だった。 Suicaのチップ、自宅のルーター、VPN、AIプラグイン。 君の現場の「普通」は、まだ安全か？

🚨 تحذير الجهات الي تستخدم (Palo Alto GlobalProtect VPN) حدثوه الان في ثغرة صدرت بتاريخ 13/5/2026 رقمها (CVE-2026-0257) في نظام (PAN-OS) الثغره تسمح بتجاوز المصادقة وإنشاء اتصال (VPN) غير مصرح به بدون كلمة مرور، وتُستغل الآن من قبل المخترقين. ـCISA أضافتها لقائمة (KEV) https://t.co/GRTz4r4CTa

🛡️ We added Palo Alto Networks PAN-OS authentication bypass vulnerability CVE-2026-0257 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/iqNABP4rQ9

⚠️⚠️ CVE-2026-0257 (CVSS 9.1): GlobalProtect auth bypass; active exploitation (CISA KEV) 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJwYWxvYWx0by1HbG9iYWxQcm90ZWN0Ig== 🎯1.1M+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="paloalto-GlobalProtect" 🔖Refer: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/ #OSINT #FOFA #CyberSecurity #Vulnerability

Explotación activa de vulnerabilidad de bypass de autenticación en PAN-OS GlobalProtect (CVE-2026-0257) https://blog.elhacker.net/2026/05/explotacion-activa-de-vulnerabilidad-de.html

Still Another VPN being compromised by attackers! 😤 And you thought your VPN was keeping you safe 😅 https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

I'm doing some analysis against the honeypots in @DefusedCyber and Claude came out with this.... (in the screenshot) https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/ https://t.co/ShLJR73IL0

GSSへの不正アクセス、時系列で見るとどこら辺から危なかったが可視化されますね。5/29が一つの分水嶺ですね。 5/13 CVE-2026-0257公開 当初CVSS 4.7「Medium」 5/17 Rapid7が実悪用を観測 5月下旬 GSSへの侵入が始まったとみられる 5/29 CISA KEV登録　CVSS 7.8へ 公開PoCも出現 つまり、 PoCが出てから攻撃されたのではない。 実悪用はPoC公開より先。 6/25 GSSで保守運用アカウントによる 大量ファイルアクセスを検知 7/9 VPN機器の脆弱性を利用した侵入と判明 アカウント停止、通信遮断、パッチ適用 9/11 デジタル庁が公表 漏えい可能性は約24.6万件。 ここで怖いのは 「PoCが出たら危険」ではない。 攻撃者は、 PoCが公開される前から動いている。 CVSS、PoC、KEVを待ってから優先順位を変えるのでは遅い。 Internet Facingか。 認証境界か。 侵害後にどこまで到達できるか。 そこまで見て、 脆弱性の優先順位を決める必要がある。 ※GSSで悪用されたVPN製品・CVE番号は非公表。CVE-2026-0257との関連は公開情報からの推測。 https://bs-square.jp/blog/index.php/2026/06/10/palo-alto-networks-globalprotect-authentication-bypass-what-security-teams-should-know-about-cve-2026-0257/