CVE-2026-0257Vulnerability
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Reported by 11 independent sources · first reported by Sekoia.io · last reported
Last reported yesterday
Fix due 1 Jun 2026
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 20 Oct 2026
What the reports say
15 reports, newest first · the exact sentence from each-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials“Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_…”
-
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619“Next: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)”
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June“Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy.”
-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“Threat Intelligence analysts have also observed the exploitation of CVE-2026-0257, an authentication bypass vulnerability affecting GlobalProtect portals and gateways on vulnerable PAN-OS configurations where authentication-override cookies and the relevant certificate configurat…”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“More ransomware groups adopt PAN bug: Two more ransomware groups—Settra and Inc—are now using a PAN-OS bug (CVE-2026-0257) to breach networks and deploy their payloads.”
-
Palo Alto's firewall OS has been under attack from multiple ransomware groups since June“CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection.”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.”
-
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA“The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.”
-
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)“Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)”
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More“Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access.”
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups“…ia advisories posted on October 9 that multiple groups, including the Qilin and Settra ransomware operations, are actively targeting CVE-2026-0257 to establish unauthorized VPN sessions and gain initial access to internal networks.”
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records“Mass Scanning for Palo Alto Networks PAN OS GlobalProtect gateways and exploiting CVE-2026-0257.”
-
Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline“…ies, the threat actor compromised critical network infrastructure, including VPN gateways via a GlobalProtect authentication bypass (CVE-2026-0257), while concurrently executing advanced web application exploits, deploying the AdaptixC2 framework, and leveraging an AI-assisted de…”
-
July 2026 CVE Landscape“CVE-2026-0257”
-
Don't Eat the ChocoPoCs: Trojanised PoCs Hit Researchers“After various unsuccessful GitHub dorks, we uncovered two additional repositories (github.com/bolubey/CVE-2026-0257 and github.com/bolubey/CVE-2026-50751) by reverse-indexing the entire github.com/nomi-sec/PoC-in-GitHub archive for 2025 and 2026 and systematically retrieving ever…”
Indicators reported together
named in the same reportsAlso named with it: CVE-2023-27532, CVE-2021-4034, CVE-2025-64446, CVE-2025-55182, CVE-2026-48908, CVE-2026-60137, CVE-2026-63030, CVE-2022-28368, CVE-2023-7028, CVE-2024-1086, CVE-2020-1938, CVE-2025-49113, CVE-2026-33824, CVE-2024-42009, CVE-2026-15409, CVE-2026-15410, CVE-2026-25089, CVE-2026-39808, CVE-2026-42897, CVE-2018-0802
Thanks — we review every report.