Security researchers and Palo Alto Networks are warning of active exploitation targeting a critical authentication bypass vulnerability within the company’s GlobalProtect VPN solution. The flaw, assigned CVE-2026-0257 and carrying a CVSS score of 7.8 (high severity), allows unauthenticated attackers to establish unauthorized VPN connections, effectively bypassing standard security protocols. This presents a significant risk for organizations relying on GlobalProtect for remote access.
The vulnerability stems from an issue with the handling of authentication override cookies and certificate reuse across different services within PAN-OS software. Attackers can forge these cookies or exploit shared certificates to gain access without providing valid credentials. Palo Alto Networks has observed this ‘active exploitation’ in the wild, indicating that threat actors are actively scanning for and exploiting vulnerable systems.
Evidence of exploitation first emerged starting May 17, 2026. The Cybersecurity and Infrastructure Security Agency (CISA subsequently added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026, highlighting the urgency of patching efforts. The initial CVSS score was assessed as 4.7 (medium), but Palo Alto Networks revised it to a more critical 7.8 following confirmation of real-world attacks.
Technical details reveal that attackers can potentially retrieve public keys due to improper cookie encryption, enabling them to craft valid tokens and bypass the authentication process. This vulnerability impacts the GlobalProtect portal and gateway components of PAN-OS, meaning a wide range of deployments are at risk. Organizations should immediately review their configurations and ensure they are applying available mitigations or patches as soon as possible.
While the exact number of affected systems remains unspecified, organizations utilizing Palo Alto Networks GlobalProtect VPN are strongly advised to prioritize patching efforts. The combination of active exploitation, a high CVSS score, and CISA’s KEV listing underscores the severity of this vulnerability and the potential for widespread compromise if left unaddressed. Consult Palo Alto Network’s security advisories for detailed guidance on mitigation strategies and patch deployment.
Sources: