HIGH Actively exploited Used in ransomware CWE-565
CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
Palo Alto Networks·PAN-OS
7.8/ 10
CVSS 4.0
High severity
96%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.9% of all CVEs
Listed
CISA KEV catalog
- Added
- May 29, 2026
- Fix due
- Jun 1, 2026
- Ransomware
- Known use
Timeline
- Published
- May 13, 2026
- Updated
- Oct 15, 2026
- First covered
- Jun 29, 2026
- Latest story
- 4 months ago
Summary
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.Panorama and Cloud NGFW are not impacted by these issues.
CWE-565Reliance on Cookies without Validation and Integrity Checking
Attack profile
Attack vectorNetwork
ComplexityLow
RequirementsNone
PrivilegesNone
User interactionNone
ConfidentialityLow
IntegrityNone
AvailabilityNone
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:RedCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS12.1.0 to before 12.1.7, 12.1.4-h611.2.0 to before 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h1711.1.0 to before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h3310.2.0 to before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
- Palo Alto Networks Prisma Access10.2.0 to before 10.2.10-h3611.2.0 to before 11.2.7-h13