Vendors and CVEs › CVEs › CVE-2026-0257
CVE-2026-0257: what it is, who is affected and what to do
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect patched in May. Cookies are not properly validated, so remote, unauthenticated attackers can set up an unauthorised VPN connection.
- Known exploited. Yes, on CISA’s list of exploited flaws.
- Records. CVE-2026-0257 on the National Vulnerability Database · CISA’s known exploited catalog
The story
High Known exploited
Ransomware groups exploit Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect patched in May.