Actively exploited · Published May 13, 2026 · Assigned by palo_alto
CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
High 7.8 Exploited Ransomware
In plain English
A high-severity security flaw in Cloud NGFW from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on May 29, 2026). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 95.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 1, 2026.
Official description
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cloud NGFW | see references |
| Palo Alto Networks | PAN-OS | 12.1.0 – before 12.1.7, 12.1.4-h611.2.0 – before 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h1711.1.0 – before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h3310.2.0 – before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 |
| Palo Alto Networks | Prisma Access | 10.2.0 – before 10.2.10-h3611.2.0 – before 11.2.7-h13 |
Weakness: CWE-565 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red