Which versions of PAN-OS GlobalProtect are affected by CVE-2026-0257?

An authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect portals (CVE-2026-0257), confirmed actively exploited (CISA KEV), allows attackers to establish unauthorized VPN…. A patch is available.

Is there a public PoC exploit available for CVE-2026-0257?

Yes, a public proof-of-concept exploit is available for CVE-2026-0257. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-0257?

Within 24 hours: Identify all PAN-OS and Prisma Access deployments and confirm running versions against CISA KEV advisory. Within 7 days: Deploy vendor-released patch from Palo Alto Networks to all affected systems. Within 30 days: Verify patch deployment across all assets and enhance VPN access monitoring and logging.

PAN-OS GlobalProtect CVE-2026-0257

Q: What is the CVSS score of CVE-2026-0257?

CVE-2026-0257 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red. EPSS exploitation probability: 0.1%.

EUVD-2026-30104 HIGH

Reliance on Cookies without Validation and Integrity Checking (CWE-565)

2026-05-13 palo_alto

GHSA-jqxw-84hx-6qj5

Paloalto Authentication Bypass

7.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:21 vuln.today

Added to CISA KEV

May 29, 2026 - 19:31 CISA

Severity Changed

May 29, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

May 29, 2026 - 18:22 NVD

4.7 (MEDIUM) 7.8 (HIGH)

Patch available

May 13, 2026 - 20:02 EUVD

CVSS changed

May 13, 2026 - 19:22 NVD

4.7 (MEDIUM)

CVE Published

May 13, 2026 - 18:15 nvd

UNKNOWN (no severity yet)

CVE Published

May 13, 2026 - 18:15 nvd

HIGH 7.8

DescriptionCVE.org

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

Panorama and Cloud NGFW are not impacted by these issues.

Articles & Coverage 2

unit42.paloaltonetworks.com CVE-2026-0257: Active Exploitation of PAN-OS Vulnerability - IOCs and Mitigations Jun 05, 2026 POC CVE-2026-0257: PAN-OS GlobalProtect Authentication Bypass via Forged TLS Certificate Cookie May 29, 2026

AnalysisAI

Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to establish unauthorized VPN connections without valid credentials. The flaw is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though EPSS remains low at 0.05%, suggesting targeted rather than mass exploitation. Panorama and Cloud NGFW deployments are not affected, but PAN-OS firewalls and Prisma Access tenants running vulnerable trains are exposed.

Technical ContextAI

PAN-OS is Palo Alto Networks' next-generation firewall operating system, and GlobalProtect is its SSL/IPsec VPN component exposing a portal (for client configuration delivery) and a gateway (for tunnel termination) typically reachable over the internet on TCP/443. The CWE-565 classification (Reliance on Cookies without Validation and Integrity Checking) indicates the authentication bypass stems from the portal/gateway trusting session or auth cookies without adequately verifying their integrity or origin, allowing crafted cookie values to impersonate an authenticated session. The CPE set covers cpe:2.3:a:palo_alto_networks:pan-os and cpe:2.3:a:palo_alto_networks:prisma_access; the cloud_ngfw CPE appears in NVD data but the vendor advisory explicitly excludes Cloud NGFW and Panorama from impact.

RemediationAI

Vendor-released patches are available - upgrade PAN-OS to 10.2.18-h6, 11.1.15, 11.2.12, or 12.1.7 (or the corresponding hotfix on your maintenance train such as 11.1.13-h5, 11.2.10-h7, 12.1.4-h6) per the Palo Alto advisory at https://security.paloaltonetworks.com/CVE-2026-0257; Prisma Access tenants should be updated to 10.2.10-h36 or 11.2.7-h13 minimum. If immediate patching is not possible, restrict GlobalProtect portal and gateway exposure by placing the management interfaces behind source-IP allowlists or a ZTNA broker, which preserves remote-access functionality only for known client networks but breaks public BYOD VPN onboarding. Enable Threat Prevention signatures published by Palo Alto for this CVE on the firewall protecting the GlobalProtect interface where feasible, monitor GlobalProtect authentication logs for sessions established without a preceding successful credential or SAML flow, and revoke and reissue any GlobalProtect session cookies/secrets after patching since the CWE-565 root cause suggests pre-patch cookies may remain abusable.