Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw

Palo Alto Networks has revealed that it has observed "active exploitation" of a recently disclosed PAN-OS vulnerability by an unknown threat actor to obtain unauthorized access to GlobalProtect portals. The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS software that could be exploited by bad

The report says Palo Alto Networks observed limited active exploitation of CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect portals and gateways that can let attackers establish unauthorized VPN connections on unpatched devices with the affected configuration.[1][3] Rapid7 and Palo Alto both indicate the issue is being used against real targets and was added to CISA’s Known Exploited Vulnerabilities catalog.[1][2][3] CyberSE.AI analysis: this is not an AI-specific incident, but it is operationally serious because it creates a low-noise path into corporate networks and should be treated as a high-priority exposure review and patching/mitigation issue.