Palo Alto GlobalProtect Auth Bypass Hits Live Exploitation
CVE-2026-0257 lets attackers stand up unauthorized VPN sessions against PAN-OS and Prisma Access. Patches are out. So are the exploits.
Key points
- CVE-2026-0257 is an authentication bypass in PAN-OS and Prisma Access carrying a CVSS score of 7.8.
- A successful exploit lets an unauthenticated attacker negotiate a VPN session against a vulnerable GlobalProtect gateway or portal.
- Palo Alto Networks has confirmed active exploitation but has not named victims or attributed the activity to a specific group.
- Patches are available; where patching is not immediate, the vendor advises disabling GlobalProtect on affected interfaces.
- No CISA Known Exploited Vulnerabilities Catalog entry existed at time of writing.
What does the flaw actually do?
The vulnerability sits in the GlobalProtect authentication path. An unauthenticated attacker who exploits it can negotiate a VPN session against a vulnerable gateway or portal, walking past the corporate network's front door without valid credentials. From there the standard post-access playbook applies: reconnaissance, credential harvesting, lateral movement.
Palo Alto's advisory notes "reports of active exploitation" without naming victims or attributing activity to any crew. That carefully minimal language is itself a signal. Palo Alto's security advisory lists the fixed builds for PAN-OS and Prisma Access tenants where the gateway component is enabled.
Why does an internet-facing VPN gateway matter so much?
Edge appliances from vendors including Palo Alto and Fortinet have spent recent years as preferred entry points for ransomware affiliates and access brokers, who sell footholds on underground forums for four- and five-figure sums. GlobalProtect portals are internet-facing by design, which makes mass scanning straightforward. Shodan-style enumeration of exposed PAN-OS instances typically returns tens of thousands of results.
We've covered Palo Alto's GlobalProtect exposure in four stories going back to our first report on 30 May 2026, and the pattern holds: the vendor's initial severity rating consistently understates the operational risk once exploits circulate.
Should you worry about the patch timeline?
Yes. Authentication bypass exploitation leaves minimal forensic residue on the appliance itself. Defenders should pull GlobalProtect authentication logs and look for successful session establishment without a corresponding successful authentication event, along with VPN clients connecting from geographies inconsistent with the user base and anomalous egress traffic from gateway management interfaces.
Where immediate patching isn't possible, the vendor's workaround is disabling GlobalProtect on affected interfaces. That's viable for isolated portals but a non-starter for most enterprises that depend on it for remote access.
No ransom demands, no leak-site posts, no named victims yet. The absence of a CISA KEV entry won't hold long if exploitation scales. Defenders who treat the patch as optional because the advisory says "medium severity" are making the same mistake that preceded several high-profile intrusions in the past two years. Patch now, hunt in the logs while you do it.
