Palo Alto Networks has warned {that a} not too long ago disclosed medium-severity safety flaw impacting PAN-OS and Prisma Entry has come below energetic exploitation within the wild.
The vulnerability, tracked as CVE-2026-0257 (CVSS rating: 7.8), refers to a case of authentication bypass that could possibly be exploited by dangerous actors to arrange VPN connections.
“Authentication bypass vulnerabilities within the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software program permit the attacker to bypass safety restrictions and set up an unauthorized VPN connection,” Palo Alto Networks stated in an advisory launched on Could 13, 2026.
The difficulty particularly impacts firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a particular certificates configuration exists, the community safety firm stated.
In an replace to its advisory on Could 29, 2026, Palo Alto Networks stated it has “develop into conscious of restricted exploit makes an attempt on unpatched PAN-OS gadgets with out mitigations utilized.
The event comes after Rapid7 revealed it recognized profitable exploitation throughout quite a few prospects, with the earliest efforts courting again to Could 17, 2026, adopted by a second wave on Could 21. Each the exploitation units are assessed to be the work of the identical menace actor.
The exercise noticed within the second wave concerned VPN IP task following the cookie authentication in two instances, granting the attacker entry to the inner community. No follow-on exercise within the buyer environments the place a VPN session was established, the cybersecurity vendor added.
“An authentication bypass in an edge dealing with enterprise VPN equipment can have vital impression to affected organizations,” Rapid7 stated. “As such, organizations operating affected home equipment are urged to improve to a vendor provided patch on an pressing foundation.”
As non permanent mitigations, it is really useful to both disable the authentication override function or generate a brand new certificates to make use of solely for the authentication override function.
The exploitation of CVE-2026-0257 follows a report from Arctic Wolf in regards to the continued weaponization of a crucial, now-patched safety flaw impacting FortiClient Endpoint Administration Server (EMS) deployments (CVE-2026-35616, CVSS rating: 9.1) to ship credential-stealing malware known as EKZ Infostealer.
