Active Exploitation of GlobalProtect Auth Bypass CVE-2026-0257

Palo Alto Networks has warned that CVE-2026-0257, a medium-severity authentication bypass in PAN‑OS GlobalProtect, is being actively exploited. The company assigned the flaw a CVSS score of 7.8 and said it affects firewalls with a GlobalProtect portal or gateway when authentication override cookies are enabled and a specific certificate configuration is present. In a May 13 advisory Palo Alto Networks wrote the flaw could ‘allow the attacker to bypass security restrictions and establish an unauthorized VPN connection.’ In an update on May 29 the vendor said it had become aware of limited exploit attempts on unpatched PAN‑OS devices without mitigations applied.

Security firm Rapid7 reported successful exploitation across multiple customers, with activity beginning on May 17 and a second wave on May 21. Rapid7 assessed both sets of activity to be the work of the same threat actor. Investigators observed VPN IP assignment after cookie authentication in two cases during the second wave, which granted the attacker access to internal networks; Rapid7 noted there was no observed follow-on activity in those customer environments. Rapid7 warned that ‘an authentication bypass in an edge facing enterprise VPN appliance can have significant impact to affected organizations’ and urged affected organizations to install vendor-supplied patches urgently.

Palo Alto Networks and responders have issued remediation guidance. The vendor listed a supplied patch as the primary fix. As temporary mitigations, administrators can disable the authentication override feature or generate a new certificate dedicated to the authentication override function to reduce exposure while patches are deployed. Organizations should check for authentication override cookie usage and the certificate configuration described by the vendor and apply available patches.

The exploitation of CVE-2026-0257 comes amid other attacks targeting remote access and endpoint management infrastructure. Security firm Arctic Wolf reported ongoing weaponization of a critical, now-patched FortiClient Endpoint Management Server vulnerability, CVE-2026-35616, which has been used to deliver credential‑stealing malware called EKZ Infostealer.

Palo Alto Networks and Rapid7 have published technical indicators and mitigation guidance for administrators to review.