CVE-2026-0257High· 7.8▾ Abyssal⚠ Exploited in the wildPoC available

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NG…

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score92/ 100 · Severe

impact 42.9 · likelihood 19.4 · exploitation 25 · ransomware 5

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 13, 2026

Updated

Oct 15, 2026

CVSS

7.8

Vendor

Palo Alto Networks

Product

Cloud NGFW

CWE

CWE-565

Depth score

92 · Severe

EPSS

97% · p100

Platforms

—

Source

CVEORG

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

Exploit availability

Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.

checked 2026-10-15

GitHub PoCs

7 public repositories

Nuclei

CVE-2026-0257.yaml ↗

CISA SSVC

decided 2026-05-28

Exploitation: active
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 155 days

May 13, 2026Published
Disclosed via CVEORG
May 29, 2026Added to CISA KEV
Federal remediation due Jun 1, 2026
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 15, 2026EPSS first tracked
97%
Oct 15, 2026Public exploit observed
7 GitHub repos · Nuclei ×1 (last check)

Palo Alto Networks CWE-565 #cve.org #in-the-wild #exploit-available #kev

CISA KEVKnown Exploited VulnerabilityRansomware campaign use

Added to the CISA catalog on May 29, 2026. Federal remediation due Jun 1, 2026. View catalog ↗

Affected

cloud_ngfw
PAN-OS >= 12.1.0 < 12.1.7, 12.1.4-h6
PAN-OS >= 11.2.0 < 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
PAN-OS >= 11.1.0 < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
PAN-OS >= 10.2.0 < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
prisma_access >= 10.2.0 < 10.2.10-h36
prisma_access >= 11.2.0 < 11.2.7-h13

Full technical detail▾

Overview

Panorama and Cloud NGFW are not impacted by these issues.

Affected

cloud_ngfw
PAN-OS >= 12.1.0 < 12.1.7, 12.1.4-h6
PAN-OS >= 11.2.0 < 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
PAN-OS >= 11.1.0 < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
PAN-OS >= 10.2.0 < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
prisma_access >= 10.2.0 < 10.2.10-h36
prisma_access >= 11.2.0 < 11.2.7-h13

Remediation

Version Minor Version Suggested Solution Cloud NGFW All No action needed. PAN-OS 12.1

                            12.1.5 through 12.1.6
                            Upgrade to 12.1.7 or later.
                        
                            
                            12.1.2 through 12.1.4-h*
                            Upgrade to 12.1.4-h6 or 12.1.7 or later.
                        
                            PAN-OS 11.2

                            11.2.11 or later
                            Upgrade to 11.2.12 or later.
                        
                            
                            11.2.8 through 11.2.10-h*
                            Upgrade to 11.2.10-h7 or 11.2.12 or later.
                        
                            
                            11.2.5 through 11.2.7-h*
                            Upgrade to 11.2.7-h14 or 11.2.12 or later.
                        
                            
                            11.2.0 through 11.2.4-h*
                            Upgrade to 11.2.4-h17 or 11.2.12 or later.
                        
                            PAN-OS 11.1

                            11.1.14 or later
                            Upgrade to 11.1.15 or later.
                        
                            
                            11.1.11 through 11.1.13-h*
                            Upgrade to 11.1.13-h5 or 11.1.15 or later.
                        
                            
                            11.1.8 through 11.1.10-h*
                            Upgrade to 11.1.10-h25 or 11.1.15 or later.
                        
                            
                            11.1.7 through 11.1.7-h*
                            Upgrade to 11.1.7-h6 or 11.1.15 or later.
                        
                            
                            11.1.5 through 11.1.6-h*
                            Upgrade to 11.1.6-h32 or 11.1.15 or later.
                        
                            
                            11.1.0 through 11.1.4-h*
                            Upgrade to 11.1.4-h33 or 11.1.15 or later.
                        
                            PAN-OS 10.2

                            10.2.17 through 10.2.18-h*
                            Upgrade to 10.2.18 or 10.2.18-h6 or later.
                        
                            
                            10.2.14 through 10.2.16-h*
                            Upgrade to 10.2.16-h7 or 10.2.18 or later.
                        
                            
                            10.2.11 through 10.2.13-h*
                            Upgrade to 10.2.13-h21 or 10.2.18 or later.
                        
                            
                            10.2.8 through 10.2.10-h*
                            Upgrade to 10.2.10-h36 or 10.2.18 or later.
                        
                            
                            10.2.0 through 10.2.7-h*
                            Upgrade to 10.2.7-h34 or 10.2.18 or later.
                        All older

unsupported PAN-OS versions Upgrade to a supported fixed version. Prisma Access 10.2

                            10.2.0 through 10.2.10-h*
                            Upgrade to 10.2.10-h36 or later.
                        
                            Prisma Access 11.2

                            11.2.0 through 11.2.7-h*
                            Upgrade to 11.2.7-h13 or later.

Note: With this fix, if the firewall is configured to use an authentication override cookie for the GlobalProtect Portal or Gateway, it will regenerate the cookie using a more secure method. Therefore, GP users will need to re-authenticate after a PAN-OS upgrade, even if a valid cookie is present. This is a one time requirement. Once they re-authenticate after the upgrade, the authentication override cookie and its validity will work as they do today.

Workarounds

Customers can mitigate the risk of this issue by taking any of the following actions:

Use a dedicated certificate for Authentication Override cookies: Generate a new certificate exclusively for authentication override cookies and store it securely. Do not reuse the portal or gateway certificate, and do not share this certificate with other features or users.
Disable Authentication Override: Uncheck the Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration.

References

https://security.paloaltonetworks.com/CVE-2026-0257

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#in-the-wild#exploit-available#kev

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score92/ 100 · Severe

impact 42.9 · likelihood 19.4 · exploitation 25 · ransomware 5

Affected

cloud_ngfw

PAN-OS >= 12.1.0 < 12.1.7, 12.1.4-h6

PAN-OS >= 11.2.0 < 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17

PAN-OS >= 11.1.0 < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33

PAN-OS >= 10.2.0 < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34

prisma_access >= 10.2.0 < 10.2.10-h36

prisma_access >= 11.2.0 < 11.2.7-h13

Remediation

Version Minor Version Suggested Solution Cloud NGFW All No action needed. PAN-OS 12.1

12.1.5 through 12.1.6 Upgrade to 12.1.7 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h6 or 12.1.7 or later. PAN-OS 11.2 11.2.11 or later Upgrade to 11.2.12 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h7 or 11.2.12 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h14 or 11.2.12 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h17 or 11.2.12 or later. PAN-OS 11.1 11.1.14 or later Upgrade to 11.1.15 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h5 or 11.1.15 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h25 or 11.1.15 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h6 or 11.1.15 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h32 or 11.1.15 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h33 or 11.1.15 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18 or 10.2.18-h6 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h7 or 10.2.18 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h21 or 10.2.18 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h36 or 10.2.18 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h34 or 10.2.18 or later. All older

unsupported PAN-OS versions Upgrade to a supported fixed version. Prisma Access 10.2

10.2.0 through 10.2.10-h* Upgrade to 10.2.10-h36 or later. Prisma Access 11.2 11.2.0 through 11.2.7-h* Upgrade to 11.2.7-h13 or later.

Workarounds

Customers can mitigate the risk of this issue by taking any of the following actions:

Use a dedicated certificate for Authentication Override cookies: Generate a new certificate exclusively for authentication override cookies and store it securely. Do not reuse the portal or gateway certificate, and do not share this certificate with other features or users.

Disable Authentication Override: Uncheck the Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration.