Attackers are exploiting Palo Alto Networks defect that initially flew under the radar

Researchers and vendors are responding to active exploitation of CVE-2026-0257, an authentication-bypass flaw in Palo Alto Networks firewalls that lets attackers forge authentication cookies to gain VPN access; Rapid7 observed multiple exploitation waves, Palo Alto escalated the severity and urged immediate patching, and CISA added the issue to its known exploited vulnerabilities catalog, though successful exploitation requires specific GlobalProtect configurations.