PAN-OS GlobalProtect authentication bypass
PAN-OS GlobalProtect portal and gateway authentication bypass allowing an unauthorized VPN connection under a specific authentication-override-cookie and certificate configuration. Actively exploited by Qilin ransomware.
- Vendor
- Palo Alto Networks
- Product
- PAN-OS (GlobalProtect portal and gateway)
- CVSS
- 9.1
- EPSS (exploit probability)
- 96.9%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-0257 being exploited?
Yes. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in CIRCL's KEV catalog. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 96.9% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-0257 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An authentication-bypass flaw in the PAN-OS GlobalProtect portal and gateway. Under a specific configuration — authentication override cookies enabled alongside a particular certificate setup, per Palo Alto Networks’ advisory — an unauthenticated attacker can establish an unauthorized VPN connection.
Affected and fixed builds, per the vendor:
- PAN-OS 12.1: patched in 12.1.7
- PAN-OS 11.2: patched in 11.2.12
- PAN-OS 11.1: patched in 11.1.15
- PAN-OS 10.2: patched in 10.2.18-h6
Cloud NGFW and Panorama are not affected. Prisma Access received corresponding patches; see the advisory for cloud-side build levels.
Scoring note. Palo Alto Networks scores this 7.8 (High) under CVSS 4.0. NVD scores it 9.1 (Critical) under CVSS 3.1. The disagreement is between scoring systems, not between findings — the flaw is the same in both.
Exploitation. Rapid7 first reported exploitation on May 17, 2026, four days after the patch. CISA added the CVE to its Known Exploited Vulnerabilities catalog on May 29, 2026, with a three-day patch deadline for federal civilian agencies. Arctic Wolf Labs documented multiple Qilin ransomware intrusions in June that traced back to unpatched GlobalProtect portals, and assessed with moderate confidence that exploitation is ongoing based on continued scanning activity — reporting via BleepingComputer, 2026-07-21.
Shadowserver tracks over 167,000 GlobalProtect instances exposed to the internet; patch status on the majority is not knowable from the outside.
See the 0dayNews writeup: Qilin exploits PAN-OS GlobalProtect CVE-2026-0257.
Other Palo Alto Networks PAN-OS CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerabilitywrite-up | [ HIGH ] | — | 1.2% | |
| CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | [ CRITICAL ] | 9.8 | 31.7% | |
| CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability | [ MEDIUM ] | 6.5 | 2.0% | |
| CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | [ CRITICAL ] | 9.1 | 98.5% | |
| CVE-2024-3393 Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | [ HIGH ] | 7.5 | 29.1% | |
| CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerabilityransomware use | [ HIGH ] | 7.2 | 94.8% | |
| CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.9% | |
| CVE-2024-3400 Palo Alto Networks PAN-OS GlobalProtect Command Injection Zero-Dayransomware usewrite-up | [ CRITICAL ] | 10.0 | 100.0% |
