PAN-OS GlobalProtect Authentication Bypass Exploited: Active Threat Landscape Revealed

PAN-OS GlobalProtect Authentication Bypass Under Active Exploitation

Palo Alto Networks disclosed that CVE-2026-0257, an authentication bypass flaw in PAN-OS and Prisma Access, is being leveraged by threat actors to forge VPN tunnels. The ↓ 7.8 CVSS rating signals a medium‑severity breach that could expose corporate networks to credential‑free entry. Security teams are urged to apply the emergency patch released this week. Without remediation, attackers can maintain persistent remote access, sidestepping multifactor controls.

“We see active exploitation in the wild,” a Palo Alto spokesperson told Reuters.

Analysts note that the timing coincides with heightened cyber activity linked to the ongoing pandemic disruptions. Enterprises should audit GlobalProtect configurations, enforce strict certificate validation, and monitor anomalous VPN logins. For further guidance, consult the vendor’s advisory and Bloomberg security brief.