Palo Alto Networks has warned {that a} not too long ago disclosed medium-severity safety flaw impacting PAN-OS and Prisma Entry has come below energetic exploitation within the wild.
The vulnerability, tracked as CVE-2026-0257 (CVSS rating: 7.8), refers to a case of authentication bypass that might be exploited by dangerous actors to arrange VPN connections.
“Authentication bypass vulnerabilities within the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software program enable the attacker to bypass safety restrictions and set up an unauthorized VPN connection,” Palo Alto Networks stated in an advisory launched on Might 13, 2026.
The problem particularly impacts firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a particular certificates configuration exists, the community safety firm stated.
In an replace to its advisory on Might 29, 2026, Palo Alto Networks stated it has “change into conscious of restricted exploit makes an attempt on unpatched PAN-OS gadgets with out mitigations utilized.
The event comes after Rapid7 revealed it recognized profitable exploitation throughout quite a few prospects, with the earliest efforts relationship again to Might 17, 2026, adopted by a second wave on Might 21. Each the exploitation units are assessed to be the work of the identical menace actor.
The exercise noticed within the second wave concerned VPN IP task following the cookie authentication in two circumstances, granting the attacker entry to the inner community. No follow-on exercise within the buyer environments the place a VPN session was established, the cybersecurity vendor added.
“An authentication bypass in an edge going through enterprise VPN equipment can have important impression to affected organizations,” Rapid7 stated. “As such, organizations working affected home equipment are urged to improve to a vendor provided patch on an pressing foundation.”
As non permanent mitigations, it is really helpful to both disable the authentication override characteristic or generate a brand new certificates to make use of completely for the authentication override characteristic.
The exploitation of CVE-2026-0257 follows a report from Arctic Wolf concerning the continued weaponization of a crucial, now-patched safety flaw impacting FortiClient Endpoint Administration Server (EMS) deployments (CVE-2026-35616, CVSS rating: 9.1) to ship credential-stealing malware known as EKZ Infostealer.
