CVE-2026-0257

This bug is like a “front door check” that can be fooled. Attackers can bypass the normal login step and set up an unauthorized VPN connection, which can let them reach your internal network as if they were an allowed user. Even if you’ve done other security hardening, this specific login bypass can defeat the intended access controls.

This matters if you run Palo Alto Networks PAN-OS with GlobalProtect portal or GlobalProtect gateway enabled, or if you use Prisma Access with the affected GlobalProtect components. It also applies to cloud NGFW and ruggedcom ape1808 firmware where the product is in scope of the vendor’s advisory.

Because the findings do not confirm default exposure, treat it as a risk whenever the GlobalProtect portal/gateway is reachable from a network an attacker can reach. If your setup exposes GlobalProtect to the internet, you should assume attackers can attempt exploitation; no login is required for the bypass itself.

This is RED because attackers are already exploiting it in limited attacks and it’s listed in CISA’s KEV catalog. CISA set a remediation due date of 2026-06-01, and the required action is to apply vendor mitigations or discontinue use if mitigations aren’t available.

Given the authentication-bypass nature, treat it as an immediate priority for any organization running GlobalProtect portal/gateway on affected PAN-OS/prisma access systems.