{"id":"CVE-2026-0257","published":"2026-05-13T19:17:01Z","modified":"2026-10-26T14:10:00Z","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","vendor":"Palo Alto Networks","product":"PAN-OS","tier":"core","eol":null,"description":{"text":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the GlobalProtect portal and gateway component of Palo Alto Networks PAN-OS allows authentication bypass, stemming from reliance on cookies without validation and integrity checking. An unauthenticated remote attacker, requiring no privileges or user interaction and only network access to the GlobalProtect portal or gateway, can bypass security restrictions and establish an unauthorized VPN connection; Panorama and Cloud NGFW are not affected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:34Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95012,"percentile":0.99861,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-05-29","dueDate":"2026-06-01","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-05-29","exploitedFirstSeen":"2026-05-29","ransomware":true,"evidence":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0257","date":"2026-05-29"},{"url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7fb4ba7-d51e-416b-b7e5-edb69fed283f","date":"2026-05-29"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-05-29"},{"url":"https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/","date":"2026-05-29"},{"url":"https://t.me/ctinow/251048","date":"2026-05-30"},{"url":"https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/","date":"2026-06-05"},{"url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-increase-in-palo-alto-networks-globalprotect-authentication-bypass-exploitation-via-cve-2026-0257/","date":"2026-06-11"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/pan-os-globalprotect-auth-bypass","date":"2026-06-11"},{"url":"https://hunt.io/blog/eastern-europe-malicious-infrastructure-report","date":"2026-06-24"},{"url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf","date":"2026-07-09"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6ae254cc040814cb0f04c713","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"EbeeOct2026 Pt5","url":"https://otx.alienvault.com/pulse/6ae189b2042138c108f4126b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6adba62cf47b44713c9e594b","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257","url":"https://otx.alienvault.com/pulse/6ad9e23fd4fb55847c1a4d96","created":"2026-10-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-565","name":"Reliance on Cookies without Validation and Integrity Checking"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0257","tags":["Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-967325.html","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated exploitation of internet-facing VPN portal","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway","start":0,"end":77}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthorized VPN connection via external remote service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows the attacker to bypass security restrictions and establish an unauthorized VPN connection","start":117,"end":213}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-785c287ab8311e1ba46a","title":"From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/","date":"2026-06-02","mentions":[{"quote":"Pirates: Strange New Tides in Business Email Compromise\r\nAugust 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection\r\nJuly 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin","start":25887,"end":26194}]},{"id":"SRC-6a06d5ec9ab99e8b6b36","title":"Token Bingo: Don't Let Your Code be the Winner","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/","date":"2026-04-24","mentions":[{"quote":"Pirates: Strange New Tides in Business Email Compromise\r\nAugust 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection\r\nJuly 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin","start":24711,"end":25018}]},{"id":"SRC-876a8c22e3a8316f7dab","title":"Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/","date":"2025-07-23","mentions":[{"quote":"Pirates: Strange New Tides in Business Email Compromise\r\nAugust 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection\r\nJuly 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin","start":36901,"end":37208}]},{"id":"SRC-4cf3172d190519e868ee","title":"Blog | Arctic Wolf","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/","date":null,"mentions":[{"quote":"Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware","start":9912,"end":9988}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-30104","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30104","exploited":true,"exploitedSince":"2026-05-29","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2026-05-29","earliestUrl":"https://github.com/sfewer-r7/CVE-2026-0257","repos":[{"name":"sfewer-r7/CVE-2026-0257","url":"https://github.com/sfewer-r7/CVE-2026-0257","stars":30,"created":"2026-05-29"},{"name":"0xredash/CVE-2026-0257","url":"https://github.com/0xredash/CVE-2026-0257","stars":3,"created":"2026-05-30"},{"name":"tushargurav28/CVE-2026-0257","url":"https://github.com/tushargurav28/CVE-2026-0257","stars":3,"created":"2026-06-03"},{"name":"akashsingh0454/CVE-2026-0257-PoC","url":"https://github.com/akashsingh0454/CVE-2026-0257-PoC","stars":2,"created":"2026-05-29"},{"name":"grayxploit/CVE-2026-0257","url":"https://github.com/grayxploit/CVE-2026-0257","stars":2,"created":"2026-06-10"}]},"nuclei":[{"id":"CVE-2026-0257","name":"Palo Alto Networks PAN-OS - Authentication Bypass","severity":"critical","path":"javascript/cves/2026/CVE-2026-0257.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-0257.yaml"}],"first":{"date":"2026-05-29","source":"PoC-in-GitHub","url":"https://github.com/sfewer-r7/CVE-2026-0257"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1133"],"provenance":"ai"}],"timeline":[{"date":"2025-07-23","kind":"report","label":"Named in arcticwolf.com: Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilitie…","url":"https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/","provenance":"machine"},{"date":"2026-04-24","kind":"report","label":"Named in arcticwolf.com: Token Bingo: Don't Let Your Code be the Winner","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/","provenance":"machine"},{"date":"2026-05-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0257","provenance":"source"},{"date":"2026-05-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sfewer-r7/CVE-2026-0257","provenance":"source"},{"date":"2026-05-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://security.paloaltonetworks.com/CVE-2026-0257","provenance":"source"},{"date":"2026-05-29","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-05-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30104","provenance":"source"},{"date":"2026-06-02","kind":"report","label":"Named in arcticwolf.com: From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook,…","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/","provenance":"machine"}],"speed":{"daysToPublicExploit":16,"firstExploitFrom":"PoC-in-GitHub","daysToKev":16},"priority":{"score":93.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 155 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}