CVE-2026-0257

Arctic Wolf observed active exploitation of CVE-2026-0257, a high-severity (CVSS 7.8) authentication bypass in Palo Alto Networks GlobalProtect that allows attackers to forge authentication-override cookies and gain unauthorized VPN sessions (including administrative access); exploitation since mid-May 2026 has led to configuration disclosure, IPsec tunnel setup, and lateral movement, and the report provides IoCs, affected versions, and remediation and mitigation guidance.