CVE-2026-0257

This bug is like a “front door check” that can be fooled. Attackers can bypass the normal login step and set up an unauthorized VPN connection, which can let them reach your internal network as if they were an allowed user. Even if you’ve done other security hardening, this specific login bypass can defeat the intended access controls.

This matters if you run Palo Alto Networks PAN-OS with GlobalProtect portal or GlobalProtect gateway enabled, or if you use Prisma Access with the affected GlobalProtect components. It also applies to cloud NGFW and ruggedcom ape1808 firmware where the product is in scope of the vendor’s advisory.

Because the findings do not confirm default exposure, treat it as a risk whenever the GlobalProtect portal/gateway is reachable from a network an attacker can reach. If your setup exposes GlobalProtect to the internet, you should assume attackers can attempt exploitation; no login is required for the bypass itself.

This is RED because attackers are already exploiting it in limited attacks and it’s listed in CISA’s KEV catalog. CISA set a remediation due date of 2026-06-01, and the required action is to apply vendor mitigations or discontinue use if mitigations aren’t available.

Given the authentication-bypass nature, treat it as an immediate priority for any organization running GlobalProtect portal/gateway on affected PAN-OS/prisma access systems.

1. Confirm exposure and configuration

   • Determine whether your PAN-OS devices have GlobalProtect “portal” and/or “gateway” configured and enabled.
   • Record your exact PAN-OS version and build.
   • If you use authentication override cookies for the GlobalProtect Portal or Gateway, note that the vendor fix will regenerate cookies, and GP users will need to re-authenticate.

2. Check whether you are in an affected scope

   • PAN-OS: the flaw affects the GlobalProtect portal and gateway.
   • Prisma Access: fixes are available for the affected releases listed below.
   • Cloud NGFW: fixes are listed as “All” in the vendor patch cards.
   • Ruggedcom ape1808 firmware: confirm your vendor status and whether the vendor advisory provides a fixed release; if not, rely on the vendor’s mitigation guidance.

3. Upgrade to the fixed versions (pick the fixed version that matches your branch)

   • PAN-OS fixed releases include:
     • 12.1.7 or 12.1.4-h6
     • 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
     • 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
     • 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
     • (Also: PAN-OS 12.1 guidance indicates upgrades should land on the specific fixed numbers above.)
   • Prisma Access fixed releases include:
     • 10.2.10-h36
     • 11.2.7-h13
   • Cloud NGFW: vendor cards indicate “fixed in All.”

4. If patching is delayed: apply mitigations/workarounds

   • Follow Palo Alto Networks’ vendor advisory and mitigation steps for this CVE.
   • The vendor advisory includes guidance around authentication override cookies; if you cannot patch immediately, follow the recommended mitigation actions for your configuration.

5. Operational validation after upgrade

   • Confirm GlobalProtect portal/gateway authentication is functioning normally.
   • Communicate to users that re-authentication may be required if authentication override cookies were used.

6. CISA timing

   • CISA KEV required action is associated with a remediation due date of 2026-06-01; prioritize remediation ahead of that timeline.

7. What to monitor (practical)

   • Look for indicators of unauthorized VPN sessions around the time window when attackers may have attempted exploitation.
   • Monitor for unusual GlobalProtect connection attempts and any authentication anomalies reported by your VPN/security logs.

Severity is critical (CVSS 9.1 reported in the input). CVE-2026-0257 is a CWE-565 issue resulting in an authentication bypass: an attacker can establish an unauthorized VPN connection by bypassing authentication checks in the GlobalProtect portal/gateway.

Exploitation status: CISA KEV listing is confirmed and added on 2026-05-29, with exploitation reported as active in limited attacks (first observed 2026-05-17). A public exploit is available and exploit maturity is therefore at least “weaponized,” indicating low effort for attackers.

Attack vector is network-based with no user interaction and no login required for exploitation as described in the findings (authentication required: none; user interaction: none). EPSS is reported as very high and rising, but KEV/news confirm real-world exploitation, which takes precedence for prioritization.

Note on scope: the technical backstop states that Panorama and Cloud NGFW are not impacted; however, the patch cards provided in the findings show fixes/patch availability for Cloud NGFW (fixed in All). Treat this as “in scope for remediation,” following the vendor’s specific guidance and your deployment’s configuration.