Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
Palo Alto Networks Unit 42 has identified active exploitation of CVE-2026-0257, a PAN-OS vulnerability related to GlobalProtect authentication, by an unidentified threat actor. The vulnerability allows unauthorized VPN connections and has been observed in GlobalProtect logs, primarily targeting devices with specific host IDs and configurations. Organizations are advised to proactively hunt for indicators, activate incident response protocols, and implement mitigations to prevent successful exploitation.
An unidentified threat actor is actively exploiting a vulnerability (CVE-2026-0257) within PAN-OS software, specifically targeting the GlobalProtect VPN service. This vulnerability involves an authentication bypass in the portal and gateway components of vulnerable PAN-OS versions, potentially allowing attackers to establish unauthorized VPN connections. Unit 42 has observed limited activity, with only a small number of devices successfully establishing VPN sessions. The activity is primarily detected through GlobalProtect logs, utilizing specific IP addresses and device identifiers. Organizations are urged to immediately review the Palo Alto Networks Security Advisory for CVE-2026-0257 and implement recommended workarounds and mitigations, including upgrading to patched versions of PAN-OS. The threat actors are using a proof-of-concept (PoC) to identify vulnerable systems and establish connections.