Fixing and finding
Jump to remediation plan
CVE ID

CVE-2026-0257

Published 2026-05-13
Updated 3 months ago
Vendor/s
Palo Alto Networks
Product/s
PAN-OS
Version/s
* > 10.2.7
KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.
CVSS Score (v3.1)
9.1
/ 10
Critical
Severity Details
Base score
9.1 Critical
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Description

Critical CVSS 9.1 authentication bypass in Palo Alto Networks PAN-OS GlobalProtect allows unauthorized VPN access. Actively exploited and KEV-listed.

CPE

Palo Alto Networks logo
Palo Alto Networks
Product Version Start Version End (excl.) Status
pan-os * 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.7 10.2.7 vulnerable
pan-os 10.2.8 10.2.8 vulnerable
pan-os 10.2.9 10.2.9 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.10 10.2.10 vulnerable
pan-os 10.2.11 10.2.11 vulnerable
pan-os 10.2.12 10.2.12 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.13 10.2.13 vulnerable
pan-os 10.2.14 10.2.14 vulnerable
pan-os 10.2.15 10.2.15 vulnerable
pan-os 10.2.16 10.2.16 vulnerable
pan-os 10.2.16 10.2.16 vulnerable
pan-os 10.2.16 10.2.16 vulnerable
pan-os 10.2.16 10.2.16 vulnerable
pan-os 10.2.17 10.2.17 vulnerable
pan-os 10.2.18 10.2.18 vulnerable
pan-os 10.2.18 10.2.18 vulnerable
pan-os 10.2.18 10.2.18 vulnerable
pan-os 11.1.0 11.1.0 vulnerable
pan-os 11.1.1 11.1.1 vulnerable
pan-os 11.1.2 11.1.2 vulnerable
pan-os 11.1.3 11.1.3 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.4 11.1.4 vulnerable
pan-os 11.1.5 11.1.5 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.6 11.1.6 vulnerable
pan-os 11.1.7 11.1.7 vulnerable
pan-os 11.1.7 11.1.7 vulnerable
pan-os 11.1.7 11.1.7 vulnerable
pan-os 11.1.7 11.1.7 vulnerable
pan-os 11.1.8 11.1.8 vulnerable
pan-os 11.1.9 11.1.9 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.10 11.1.10 vulnerable
pan-os 11.1.11 11.1.11 vulnerable
pan-os 11.1.12 11.1.12 vulnerable
pan-os 11.1.13 11.1.13 vulnerable
pan-os 11.1.13 11.1.13 vulnerable
pan-os 11.1.13 11.1.13 vulnerable
pan-os 11.1.13 11.1.13 vulnerable
pan-os 11.1.14 11.1.14 vulnerable
pan-os 11.2.0 11.2.0 vulnerable
pan-os 11.2.1 11.2.1 vulnerable
pan-os 11.2.2 11.2.2 vulnerable
pan-os 11.2.3 11.2.3 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.4 11.2.4 vulnerable
pan-os 11.2.5 11.2.5 vulnerable
pan-os 11.2.6 11.2.6 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.7 11.2.7 vulnerable
pan-os 11.2.8 11.2.8 vulnerable
pan-os 11.2.9 11.2.9 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.10 11.2.10 vulnerable
pan-os 11.2.11 11.2.11 vulnerable
pan-os 12.1.2 12.1.2 vulnerable
pan-os 12.1.3 12.1.3 vulnerable
pan-os 12.1.4 12.1.4 vulnerable
pan-os 12.1.4 12.1.4 vulnerable
pan-os 12.1.4 12.1.4 vulnerable
pan-os 12.1.4 12.1.4 vulnerable
pan-os 12.1.5 12.1.5 vulnerable
pan-os 12.1.6 12.1.6 vulnerable
prisma_access - - vulnerable
pan-os 10.2.0 10.2.10 unaffected
pan-os 11.2.0 11.2.7 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 10.2.10 10.2.10 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
pan-os 11.2.7 11.2.7 unaffected
ruggedcom_ape1808_firmware - - vulnerable
ruggedcom_ape1808 - - unaffected

Related weakness (CWE)

CWE-565

Remediation plan

1

Apply official patches

Immediately download and install the latest maintenance releases or hotfixes provided by Palo Alto Networks for your specific PAN-OS version. Refer to the vendor's security advisory for CVE-2026-0257 to identify the correct update path.

2

Update affected systems

Ensure all GlobalProtect-enabled firewalls are updated to non-vulnerable versions. Affected branches include PAN-OS 10.2, 11.1, 11.2, and 12.1. Verify that your deployment is running a version released after the vulnerability was disclosed, such as 10.2.11-h1 or higher depending on your branch.

3

Restrict access

As an immediate mitigation, restrict access to the GlobalProtect portal and gateway to trusted IP ranges using security policies. If the portal is not required for external users, disable it or place it behind an additional layer of authentication until patches are applied.

4

Monitor for exploitation

Review GlobalProtect logs for anomalous successful VPN sessions, especially those that lack corresponding multi-factor authentication (MFA) logs or originate from unexpected geographic locations. Look for session creation events that do not align with standard user behavior.

Detection Guidance

"Security teams should monitor PAN-OS system logs for successful authentication events on the GlobalProtect portal and gateway that appear suspicious. Indicators of compromise include VPN sessions established without associated MFA prompts or logins from unknown IP addresses. Check for CWE-565 related indicators, such as manipulated cookies or session tokens. Utilize automated log analysis to correlate GlobalProtect session starts with external authentication provider logs to identify unauthorized bypass attempts."

References

https://security.paloaltonetworks.com/CVE-2026-0257 Vendor Advisory https://cert-portal.siemens.com/productcert/html/ssa-967325.html Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257 US Government Resource

Sources

NIST National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

Get a demo
Free trial