{"id":"palo-alto-globalprotect-authentication-bypass-may-2026","category":"patch","status":"live","title":"Palo Alto Networks GlobalProtect VPN sign-in bypass CVE-2026-0257 exploited by ransomware gangs","tldr":"Attackers are using a GlobalProtect VPN flaw to enter business networks without valid credentials, including for ransomware. Ask IT to install the correct PAN-OS fix, confirm Prisma Access upgrades and investigate suspicious VPN connections.","summary":"CVE-2026-0257 lets attackers establish unauthorised GlobalProtect VPN connections to affected business networks without valid credentials. Exposure requires authentication override cookies and a particular certificate configuration. Palo Alto Networks disclosed the flaw on 13 May; Rapid7 traced exploitation to 17 May. Arctic Wolf subsequently linked June intrusions to Qilin ransomware, including cases involving stolen data. In October, Palo Alto Networks’ Unit 42 identified both Qilin and INC operators exploiting the flaw and bypassing multi-factor authentication. PAN-OS fixes are available across the listed branches. Overall patch status remains partial because the vendor still describes Prisma Access customer upgrades as a scheduled rollout, without confirming completion. As at 3 November, the latest substantive vendor threat update reviewed is from October; it does not declare the attacks over.","action":"If your business or family office uses GlobalProtect, ask IT to update every portal and gateway to the fixed release for its branch listed below and confirm the Prisma Access upgrade status. Until updated, administrators should disable Authentication Override in both portal and gateway settings. Ask them to investigate suspicious VPN connections using Unit 42’s guidance.","product":"Palo Alto Networks PAN-OS GlobalProtect VPN and Prisma Access","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-0257"],"tags":["palo-alto-networks","pan-os","globalprotect","prisma-access","vpn","authentication-bypass","ransomware"],"affected":["Exposure requires a GlobalProtect portal or gateway with authentication override cookies enabled and a specific certificate configuration.","PAN-OS 12.1: before the applicable fixed release, 12.1.4-h6 or 12.1.7.","PAN-OS 11.2: before the applicable fixed release, 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12.","PAN-OS 11.1: before the applicable fixed release, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15.","PAN-OS 10.2: before the applicable fixed release, 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6.","Prisma Access 10.2.0: before 10.2.10-h36.","Prisma Access 11.2.0: before 11.2.7-h13."],"fixed":["PAN-OS 12.1: 12.1.4-h6 or 12.1.7 and later, as applicable.","PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later, as applicable.","PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later, as applicable.","PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later, as applicable.","Prisma Access 10.2: 10.2.10-h36 and later; customer rollout completion unconfirmed.","Prisma Access 11.2: 11.2.7-h13 and later; customer rollout completion unconfirmed."],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities","url":"https://security.paloaltonetworks.com/CVE-2026-0257","by":"Palo Alto Networks","date":"2026-06-03"},{"kind":"advisory","title":"CISA Known Exploited Vulnerabilities catalogue — 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"research","title":"Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)","url":"https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/","by":"Rapid7","date":"2026-06-03"},{"kind":"research","title":"Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware","url":"https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/","by":"Arctic Wolf Labs","date":"2026-07-20"},{"kind":"research","title":"Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)","url":"https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/","by":"Palo Alto Networks Unit 42","date":"2026-10-20"}],"started":"2026-05-13","closed":null,"created":"2026-11-03T22:07:13.512Z","updated":"2026-11-03T22:07:13.512Z","cve_notes":[{"cve":"CVE-2026-0257","name":"Authentication bypass in GlobalProtect VPN","what":"A flaw in PAN-OS GlobalProtect portal and gateway authentication lets remote attackers establish unauthorised VPN connections when authentication override cookies and a particular certificate configuration are used.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-19","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Unit 42 identified Qilin and INC ransomware operators exploiting the flaw to enter corporate networks and bypass multi-factor authentication. Its investigations had continued since early June across numerous industries.","url":"https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/","by":"Palo Alto Networks Unit 42","patch":null},{"at":"2026-07-20","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Arctic Wolf reported multiple June intrusions that began with this flaw and ended in Qilin ransomware encryption. Some also involved data theft and extortion.","url":"https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/","by":"Arctic Wolf Labs","patch":null},{"at":"2026-06-03","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"The vendor added upgrade FAQs requiring all cookie-sharing GlobalProtect portals and gateways to be updated. Its advisory lists fixed releases but describes Prisma Access customer upgrades as an ongoing scheduled rollout.","url":"https://security.paloaltonetworks.com/CVE-2026-0257","by":"Palo Alto Networks","patch":"partial"},{"at":"2026-05-29","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"Palo Alto Networks acknowledged limited exploitation attempts against unpatched devices without mitigations. Rapid7 reported that the vendor raised its severity score from 4.7 to 7.8.","url":"https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/","by":"Rapid7","patch":null},{"at":"2026-05-29","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added the flaw to its exploited-vulnerability catalogue, which now records known ransomware use. Unit 42 gives 13 May as the listing date, but CISA’s own entry says 29 May.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-05-17","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Rapid7 later identified this as its earliest observed exploitation date. It found successful exploitation across several customers, but initially found no evidence of attackers moving further through their networks.","url":"https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/","by":"Rapid7","patch":null},{"at":"2026-05-13","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Palo Alto Networks disclosed CVE-2026-0257, a GlobalProtect VPN sign-in bypass affecting particular PAN-OS and Prisma Access configurations.","url":"https://security.paloaltonetworks.com/CVE-2026-0257","by":"Palo Alto Networks","patch":null}],"url":"https://hard.fyi/live/palo-alto-globalprotect-authentication-bypass-may-2026/","json":"https://hard.fyi/api/live?id=palo-alto-globalprotect-authentication-bypass-may-2026"}