PAN-OS GlobalProtect Authentication Bypass CVE-2026-0257 Under Active Exploitation

A confirmed authentication bypass in Palo Alto Networks PAN-OS and Prisma Access is actively being exploited in the wild. If GlobalProtect is your VPN gateway, patching is not optional — it is overdue.

What Happened

Palo Alto Networks has warned that CVE-2026-0257, a CVSS 7.8-rated authentication bypass affecting PAN-OS and Prisma Access, has moved from disclosed to actively weaponized. The vulnerability lives inside the GlobalProtect component — the SSL VPN portal that remote workers authenticate through before being granted network access. Threat actors are exploiting it now, in real environments, against real organizations.

Do not let the "medium severity" label fool you. CVSS scores reflect theoretical impact in isolation; they do not account for where in your architecture the flaw sits. GlobalProtect is the front door.

Why It Matters

An authentication bypass on a perimeter VPN gateway is one of the most dangerous classes of vulnerability an organization can face. It allows an unauthenticated attacker to skip credential verification entirely — no username, no password, no MFA challenge — and land directly inside network segments that every other control assumes are already protected. By the time endpoint detection, segmentation rules, or SIEM alerts have a chance to fire, the attacker already has a foothold.

This is not a theoretical edge case. Authentication bypasses on GlobalProtect-class products have a consistent track record of translating into full network compromise in the wild. Prisma Access cloud tenants are also in scope, so no deployment model is exempt.

The active exploitation status means exploit code or a reliable technique is already in circulation. The window between disclosure and mass scanning is effectively closed.

What To Do

1. Patch now. Consult Palo Alto's advisory via The Hacker News to identify your affected PAN-OS version and apply the fix. This does not wait for the next change window.

1. Check for compromise first. Before patching, review GlobalProtect authentication logs for successful sessions that have no corresponding valid credential event — a hallmark of a bypass being used. If you see anomalies, treat the host as potentially compromised before proceeding.

1. Update Threat Prevention content. Palo Alto typically releases detection signatures alongside CVE patches. Ensure your Threat Prevention subscription is active and content updates are current to catch exploitation attempts at the network layer.

1. Verify Prisma Access auto-update status. Cloud-managed tenants may require manual confirmation that the fix has been applied. Do not assume automatic updates ran successfully — check your tenant's software version explicitly.

1. Restrict portal exposure if patching is delayed. If you cannot patch immediately, IP-allowlist the GlobalProtect portal to known egress ranges and consider taking it offline for user populations where downtime is acceptable.

The exploitation window for high-value perimeter vulnerabilities is now measured in hours, not days. Treat this accordingly.