CVE Feed

    Dashboard / CVE / CVE-2026-0257

    CVE-2026-0257

    Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

    Published:May 13, 2026
    Last Modified:Jun 9, 2026
    EPS:May 13, 2026
    EPSS Score:0.58788
    CVSS Score:9.1

    CISA Notification

    Description

    Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

    Required Action:

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Jun 1, 2026
    102 days ago
    Alert Date
    May 29, 2026
    105 days ago

    Affected Products

    Vendor
    Palo Alto Networks
    Product
    Cloud Ngfw
    Vendor
    Palo Alto Networks
    Product
    Pan-os
    Vendor
    Palo Alto Networks
    Product
    Prisma Access
    Vendor
    Paloaltonetworks
    Product
    Pan-os
    Vendor
    Paloaltonetworks
    Product
    Prisma Access
    Vendor
    Siemens
    Product
    Ruggedcom Ape1808
    Vendor
    Siemens
    Product
    Ruggedcom Ape1808 Firmware

    Exploits

    https://github.com/0xBlackash/CVE-2026-0257https://github.com/akashsingh0454/CVE-2026-0257-PoChttps://github.com/Ez4rd1x1/CVE-2026-0257https://github.com/grayxploit/CVE-2026-0257https://github.com/HORKimhab/CVE-2026-0257https://github.com/Mr-Robot-LP/CVE-2026-0257https://github.com/sfewer-r7/CVE-2026-0257https://github.com/tushargurav28/CVE-2026-0257

    Related CVEs

    CVE-2026-0310 (CVSS 7.2) — A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software ena…
    CVE-2026-0301 (CVSS 1.7) — An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software en…
    CVE-2026-0279 (CVSS 1.3) — Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) servi…
    CVE-2026-0280 (CVSS 1.7) — An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an una…
    CVE-2026-0281 (CVSS 2.1) — An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated atta…
    CVE-2026-0282 (CVSS 2.7) — A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with …
    CVE-2026-0283 (CVSS 4.5) — An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS …
    CVE-2026-0284 (CVSS 4.7) — An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® soft…
    CVE-2026-0285 (CVSS 4.7) — A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authentica…
    CVE-2026-0286 (CVSS 6) — A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an au…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High