How severe is CVE-2026-0257?

CVE-2026-0257 has a CVSS 4.0 base score of 7.8 (HIGH). EPSS estimates a 96.4% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-0257: PAN-OS: GlobalProtect Authentication Bypass

CISA Known Exploited Vulnerabilities

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2026-05-29

Remediation due

2026-06-01

Ransomware

Known use

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257

Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Severity

CVSS 4.0 · CNA7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Palo Alto Networks	Cloud NGFW	All (unaffected)
Palo Alto Networks	PAN-OS	12.1.0 to <12.1.7, 12.1.4-h6 (fixed ≥ 12.1.7, 12.1.4-h6) 11.2.0 to <11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17 (fixed ≥ 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17) 11.1.0 to <11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33 (fixed ≥ 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33) 10.2.0 to <10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 (fixed ≥ 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34)
Palo Alto Networks	Prisma Access	10.2.0 to <10.2.10-h36 (fixed ≥ 10.2.10-h36) 11.2.0 to <11.2.7-h13 (fixed ≥ 11.2.7-h13)

References

1 Links

Vendor advisories

https://security.paloaltonetworks.com/CVE-2026-0257

Record Details

Published

2026-05-13

Last updated

2026-07-14

Assigner (CNA)

palo_alto

Credited to

Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.

More from Palo Alto Networks

CVE-2024-340010

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

CVE-2024-00129.3

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

CVE-2024-94659.2

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

CVE-2024-94639.9

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-565 · Reliance on Cookies without Integrity Checking

Application Security Tools Data Security Software

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.