CVE-2026-0257
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Published May 13, 2026 · updated Jun 17, 2026 · Palo Alto Networks PAN-OS
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
Timeline
Detection, updates, and resolution for this record.
May 13, 2026 · Catalog
Detected
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
May 29, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 1, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Jun 1, 2026
Affected
- cpe paloaltonetworks/pan-osversion unspecified
- cpe paloaltonetworks/pan-os10.2.7
- cpe paloaltonetworks/prisma accessversion unspecified
- cpe siemens/ruggedcom ape1808 firmwareversion unspecified
- vendor Palo Alto Networks PAN-OSversion unspecified
Sources
- CISA KEVCVE-2026-0257
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
cisa.gov - CVE.orgCVE-2026-0257
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-0257
30-day exploitation probability 96.9%
first.org - NIST NVDCVE-2026-0257
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
nvd.nist.gov