PAN-OS VPN Flaw Is Being Exploited Right Now
Palo Alto Networks confirms hackers are abusing a login bypass in its GlobalProtect VPN. A small number of attempts have succeeded.
Key points
- Palo Alto Networks' own threat researchers confirmed active exploitation of CVE-2026-0257, a login bypass in the GlobalProtect VPN built into PAN-OS firewalls.
- The flaw was added to the US government's Known Exploited Vulnerabilities catalog on the same day a public proof-of-concept exploit went live.
- Only a small share of probed devices accepted a VPN session, but every successful connection should be treated as a possible intrusion.
- Palo Alto's researchers haven't yet seen attackers move deeper into victim networks, which usually means the campaign is still in its early reconnaissance phase.
- Threat Vectr's own tracking of leak-site posts shows no ransomware crew has yet claimed a victim tied to this bug, though that gap often closes within weeks.
Palo Alto Networks has confirmed that hackers are breaking into corporate VPNs by abusing a flaw in its own firewall software. CVE-2026-0257 lets an attacker skip the login screen on GlobalProtect, the remote-access VPN (the encrypted tunnel staff use to reach office systems from home) that ships with PAN-OS firewalls.
The company's threat research team published its findings this week after watching an unidentified group probe internet-facing firewalls at scale. Most probes failed. A small portion succeeded, producing what Palo Alto calls "gateway-connected events," meaning the attacker got a working VPN session on the target's network.
As first reported by The Hacker News, the flaw sits in both the portal and gateway components of vulnerable PAN-OS builds. Those are the two front doors the firewall exposes to the public internet so remote workers can log in. Either one can be walked straight through on an unpatched device.
How bad is this, really?
Bad enough that CISA, the US cybersecurity agency, added it to its Known Exploited Vulnerabilities catalog on the same day a working exploit was published. That listing forces federal agencies to patch within a short deadline and is the clearest signal defenders get that a bug is being used in the wild. We covered a separate PAN-OS code injection bug reaching that same threshold in our story from 15 October, which suggests Palo Alto's products are drawing sustained attacker interest right now.
Palo Alto's researchers say they haven't yet seen the attackers do anything after getting in. No file theft, no ransomware, no sideways movement to other machines. That's either good news or an early warning, depending on how fast your team patches.
Who is at risk?
Any organisation running an unpatched PAN-OS firewall with GlobalProtect exposed to the internet. That covers a large share of mid-size and enterprise networks. Ordinary consumers don't run these devices, but the companies that hold their data very often do.
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-0257 |
| Product | PAN-OS GlobalProtect portal and gateway |
| Flaw type | Authentication bypass |
| Post-exploit activity seen | None reported |
What should defenders do today?
Patch, then hunt. Palo Alto's advisory lists the fixed PAN-OS versions and interim workarounds for teams that can't upgrade immediately. The research team has also published indicators of compromise, including attacker IP addresses observed before the proof-of-concept dropped, and recommends searching GlobalProtect logs for matches going back several weeks.
Any hit on those indicators that also produced a gateway-connected event should trigger a full incident response. A successful VPN login from an attacker is effectively an employee badge handed to a stranger.
The broader lesson here is one this beat keeps returning to: when a single firewall product sits in front of thousands of networks, a single login bypass becomes everyone's problem at once. Watch whether a ransomware crew claims a victim tied to this flaw in the coming weeks. That's the clock that matters.
