Paper/Archive/CVE-2026-0257

CVE-2026-0257

Palo Alto Networks Cloud NGFW — PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

KEV · due 1 Jun ransomware use EPSS 95%public exploit SSVC act CVSS 9.1

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 In CISA KEV+3030.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Affected

ProductAffectedFixed inSource

Cloud NGFWsee advisoryAllCNA

PAN-OS12.1.0 – < 12.1.7, 12.1.4-h612.1.7, 12.1.4-h6CNA

PAN-OS11.2.0 – < 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h1711.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17CNA

PAN-OS11.1.0 – < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h3311.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33CNA

PAN-OS10.2.0 – < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h3410.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34CNA

Prisma Access10.2.0 – < 10.2.10-h3610.2.10-h36CNA

Prisma Access11.2.0 – < 11.2.7-h1311.2.7-h13CNA

RUGGEDCOM APE1808all versions–siemens-SADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

palo_alto (CNA)7.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

advisorysecurity.paloaltonetworks.com/CVE-2026-0257 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257 refcert-portal.siemens.com/productcert/html/ssa-967325.html kevcisa.gov/known-exploited-vulnerabilities-catalog