Palo Alto Warns GlobalProtect VPN Flaw Is Being Actively Exploited

Palo Alto Networks and Unit 42 warn of active exploitation of CVE-2026-0257 in GlobalProtect (PAN-OS), where attackers forge authentication cookies to bypass login and establish VPN sessions; multiple IOCs are provided, exploitation has been observed in the wild, and immediate patching, disabling authentication override, dedicated certificates, log review and threat hunting are recommended.