PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

Palo Alto Networks PAN-OS and Prisma Access suffer from an authentication bypass vulnerability (CVE-2026-0257, CVSS 7.8) that is currently under active exploitation in the wild.

• •The vulnerability affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and specific certificate configurations exist
• •Rapid7 identified successful exploitation attempts starting from May 17, 2026, with a second wave on May 21, assessed to be from the same threat actor
• •In some cases, attackers established VPN connections and gained access to internal networks after bypassing authentication
• •Temporary mitigations include disabling the authentication override feature or generating a new certificate for the authentication override feature
• •