Palo Alto Networks has warned {that a} just lately disclosed medium-severity safety flaw impacting PAN-OS and Prisma Entry has come below lively exploitation within the wild.
The vulnerability, tracked as CVE-2026-0257 (CVSS rating: 7.8), refers to a case of authentication bypass that might be exploited by unhealthy actors to arrange VPN connections.
“Authentication bypass vulnerabilities within the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software program enable the attacker to bypass safety restrictions and set up an unauthorized VPN connection,” Palo Alto Networks stated in an advisory launched on Could 13, 2026.
The problem particularly impacts firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a particular certificates configuration exists, the community safety firm stated.
In an replace to its advisory on Could 29, 2026, Palo Alto Networks stated it has “change into conscious of restricted exploit makes an attempt on unpatched PAN-OS units with out mitigations utilized.
The event comes after Rapid7 revealed it recognized profitable exploitation throughout quite a few prospects, with the earliest efforts relationship again to Could 17, 2026, adopted by a second wave on Could 21. Each the exploitation units are assessed to be the work of the identical menace actor.
The exercise noticed within the second wave concerned VPN IP project following the cookie authentication in two instances, granting the attacker entry to the inner community. No follow-on exercise within the buyer environments the place a VPN session was established, the cybersecurity vendor added.
“An authentication bypass in an edge dealing with enterprise VPN equipment can have important impression to affected organizations,” Rapid7 stated. “As such, organizations operating affected home equipment are urged to improve to a vendor equipped patch on an pressing foundation.”
As non permanent mitigations, it is advisable to both disable the authentication override function or generate a brand new certificates to make use of completely for the authentication override function.
The exploitation of CVE-2026-0257 follows a report from Arctic Wolf in regards to the continued weaponization of a important, now-patched safety flaw impacting FortiClient Endpoint Administration Server (EMS) deployments (CVE-2026-35616, CVSS rating: 9.1) to ship credential-stealing malware referred to as EKZ Infostealer.
