Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV · ACTIVELY EXPLOITED

CVE-2026-0257 — PAN-OS

CVE-2026-0257 is a CWE-565 vulnerability in palo_alto_networks pan-os. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-05-29) and has been used in ransomware campaigns — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
3 known
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-05-29 — including use in ransomware campaigns. Federal agencies were required to remediate by 2026-06-01.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2026-0257.

EPSS Exploitation Probability

via FIRST.org ↗
96.9%probability of exploitation in next 30 days
Very High Risk+2.99%
Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk
24.9%49.9%75.0%100.0%41.5%93.9%96.9%Jun 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

Panorama and Cloud NGFW are not impacted by these issues.

Affected Products

1 product · 191 configurations
OS
pan-ospalo_alto_networks
50 versions
10.2.010.2.110.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.910.2.1010.2.11
Exploits & PoCs
3

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

sfewer-r7/CVE-2026-0257

Proof-of-concept script to leverage the PAN-OS GlobalProtect authenticat

⭐ 30🍴 10Sep 2026

0xBlackash/CVE-2026-0257

CVE-2026-0257

⭐ 3🍴 1Jun 2026

tushargurav28/CVE-2026-0257

Palo Alto Networks PAN-OS contains an authentication bypass caused by fl

⭐ 3🍴 0Jun 2026

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every palo_alto_networks pan-os deployment and check each version against the affected-products list above.

  2. Remediation status

    No patch has shipped for CVE-2026-0257 yet — track the palo_alto_networks pan-os advisory for a fixed release and apply the workarounds below in the meantime.

  3. Mitigate without a patch

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
O3 Security · Runtime Protection

Is CVE-2026-0257 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
Actively Exploited: CVE-2026-0257: PAN-OS