Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw

Palo Alto Networks reported active exploitation of PAN-OS CVE-2026-0257 (CVSS 7.8), an authentication bypass affecting GlobalProtect portal and gateway components that can allow unauthorized VPN connections; limited exploitation was observed beginning May 17, 2026, with no post-access lateral movement identified. The report includes IoCs (IP addresses, hostnames, MACs), PoC client configuration values to search for in GlobalProtect logs, and notes CISA added the CVE to its KEV catalog with mitigation orders for federal agencies.