CVE-2026-0257
Palo Alto Networks PAN-OS: Authentication Bypass
As of , CVE-2026-0257 in Palo Alto Networks PAN-OS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.
- Exploited
- Yes: CISA listed it on 29 May 2026
- US federal deadline
- 1 June 20263 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- KnownCISA changed it from Unknown to Known on 21 July 2026.
- EPSS score
- 0.97Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: security.paloaltonetworks.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
CISA's description
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
The CVE record's description, from palo_alto
- CVE published
- 13 May 2026
- Assigned by
- palo_alto
- CVSS
- 7.8 High (CVSS 4.0, from the CNA)
- CWE-565
- Reliance on Cookies without Validation and Integrity Checking
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
EPSS since listing
Show the numbers
| From | EPSS |
|---|---|
| 0.96 | |
| 0.97 |
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
- CISA changed its entry. Ransomware use: Unknown to Known.
PAN-OS: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2017-15944Remote Code Execution | Palo Alto Networks PAN-OS | Patch this weekMetasploit module; EPSS 0.98; verified Exploit-DB entry | 0.98 | ||
| CVE-2024-0012Management Interface Authentication Bypass | Palo Alto Networks PAN-OS | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2024-9474Management Interface OS Command Injection | Palo Alto Networks PAN-OS | Patch this weekRansomware use; Metasploit module; EPSS 0.95 | 0.95 | ||
| CVE-2024-3400Command Injection | Palo Alto Networks PAN-OS | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2025-0108Authentication Bypass | Palo Alto Networks PAN-OS | Patch this weekEPSS 0.98 | 0.98 | ||
| CVE-2019-1579Remote Code Execution | Palo Alto Networks PAN-OS | Patch this weekRansomware use | 0.46 | ||
| CVE-2020-2021Authentication Bypass | Palo Alto Networks PAN-OS | Patch this weekRansomware use | 0.04 | ||
| CVE-2026-0300Out-of-bounds Write | Palo Alto Networks PAN-OS | Patch soon | 0.32 | ||
| CVE-2024-3393Malicious DNS Packet | Palo Alto Networks PAN-OS | Patch soon | 0.29 | ||
| CVE-2022-0028Reflected Amplification Denial-of-Service | Palo Alto Networks PAN-OS | Patch soon | 0.03 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org