Executive Summary
In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability (CVE-2026-0257) in their PAN-OS GlobalProtect portal and gateway, allowing unauthenticated attackers to establish unauthorized VPN connections. Initially rated as medium severity, the flaw's risk escalated when active exploitation was observed starting May 17, 2026, leading to unauthorized access attempts on corporate networks. (security.paloaltonetworks.com)
The active exploitation of CVE-2026-0257 underscores the critical need for organizations to promptly apply security patches and review VPN configurations to prevent unauthorized access, especially as attackers increasingly target remote access solutions.
Why This Matters Now
The active exploitation of CVE-2026-0257 highlights the urgency for organizations to apply patches and review VPN configurations to prevent unauthorized access, as attackers increasingly target remote access solutions.
Attack Path Analysis
Attackers exploited CVE-2026-0257 to bypass authentication on unpatched GlobalProtect portals, establishing unauthorized VPN connections. Upon access, they potentially escalated privileges by exploiting misconfigurations or vulnerabilities within the internal network. With elevated privileges, attackers could move laterally across the network, accessing sensitive systems and data. They established command and control channels to maintain persistent access and exfiltrate data. Sensitive information was exfiltrated through these channels. The attack culminated in significant data loss and potential operational disruption.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited CVE-2026-0257 to bypass authentication on unpatched GlobalProtect portals, establishing unauthorized VPN connections.
Related CVEs
CVE-2026-0257
CVSS 9.1Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software allow attackers to bypass security restrictions and establish unauthorized VPN connections.
Affected Products:
Palo Alto Networks PAN-OS – < 12.1.4-h6, < 12.1.7, < 11.2.4-h17, < 11.2.7-h14, < 11.2.10-h7, < 11.2.12, < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15, < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6
Palo Alto Networks Prisma Access – < 11.2.7-h13*, < 10.2.10-h36*
Exploit Status:
exploited in the wildReferences:
MITRE ATT&CK® Techniques
Modify Authentication Process
Valid Accounts
External Remote Services
Application Layer Protocol
Remote Services
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for Remote Access
Control ID: 8.3.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity
Control ID: Pillar 1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Banking/Mortgage
VPN authentication bypass threatens financial networks with unauthorized access, compromising customer data and violating PCI compliance requirements for secure connectivity.
Health Care / Life Sciences
GlobalProtect vulnerabilities expose patient networks to unauthorized VPN connections, risking HIPAA violations and compromising protected health information access controls.
Government Administration
Federal agencies face CISA-mandated June 1 deadline for VPN security patches, with authentication bypass threatening classified networks and citizen data.
Financial Services
Authentication override cookie exploitation bypasses Zero Trust network controls, enabling lateral movement threats against encrypted financial transactions and client communications.
Sources
- Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attackshttps://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/Verified
- NVD - CVE-2026-0257https://nvd.nist.gov/vuln/detail/CVE-2026-0257Verified
- CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilitieshttps://security.paloaltonetworks.com/CVE-2026-0257Verified
- Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit unauthorized access and lateral movement within the network, thereby reducing the attacker's ability to escalate privileges and exfiltrate sensitive data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to establish unauthorized VPN connections would likely be constrained, reducing the risk of initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained, reducing the risk of unauthorized access to sensitive systems.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally across the network would likely be constrained, reducing the risk of unauthorized access to sensitive systems and data.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be constrained, reducing the risk of persistent access and data exfiltration.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive information would likely be constrained, reducing the risk of data loss.
The overall impact of the attack would likely be constrained, reducing the risk of significant data loss and operational disruption.
Impact at a Glance
Affected Business Functions
- Remote Access Services
- Network Security
- IT Infrastructure Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of internal network data and resources due to unauthorized VPN access.
Recommended Actions
Key Takeaways & Next Steps
- • Apply the latest security patches to GlobalProtect portals to remediate CVE-2026-0257.
- • Disable authentication override cookies or use distinct certificates for different services to prevent unauthorized access.
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Enhance monitoring and anomaly detection to identify unauthorized access and data exfiltration attempts.
- • Regularly review and update security configurations to mitigate potential vulnerabilities.
