Palo Alto Networks · PAN-OS
A flaw in the GlobalProtect portal and gateway component of Palo Alto Networks PAN-OS allows authentication bypass, stemming from reliance on cookies without validation and integrity checking. An unauthenticated remote attacker, requiring no privileges or user interaction and only network access to the GlobalProtect portal or gateway, can bypass security restrictions and establish an unauthorized VPN connection; Panorama and Cloud NGFW are not affected.
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
First seen exploited 16 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 16 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Unauthorized VPN connection via external remote service
allows the attacker to bypass security restrictions and establish an unauthorized VPN connection
Unauthenticated exploitation of internet-facing VPN portal
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2026-0257 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Pirates: Strange New Tides in Business Email Compromise August 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection July 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin…
Pirates: Strange New Tides in Business Email Compromise August 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection July 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin…
Pirates: Strange New Tides in Business Email Compromise August 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection July 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin…
Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.