CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
- Record
CVE-2026-0257- CVSS 4.0
- 7.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red - Weakness
- CWE-565
- Updated
- 2026-11-02
EUVDEUVD-2026-30104
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
- Record
EUVD-2026-30104- CVSS 4.0
- 7.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jqxw-84hx-6qj5
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto...
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
- Record
GHSA-jqxw-84hx-6qj5- CVSS 4.0
- 4.7 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-565
- Updated
- 2026-11-02
CISA KEV No score
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
- Record
CVE-2026-0257- Weakness
- CWE-565
- Updated
- 2026-11-02
NVD
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
- Record
CVE-2026-0257- CVSS 4.0
- 7.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-565
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | akashsingh0454/CVE-2026-0257-PoC | 2026-05-29 |
| PoC in GitHub | sfewer-r7/CVE-2026-0257 | 2026-05-29 |
| PoC in GitHub | 0xBlackash/CVE-2026-0257 | 2026-05-30 |
| PoC in GitHub | HORKimhab/CVE-2026-0257 | 2026-05-30 |
| PoC in GitHub | tushargurav28/CVE-2026-0257 | 2026-06-03 |
| PoC in GitHub | grayxploit/CVE-2026-0257 | 2026-06-10 |
| PoC in GitHub | Ez4rd1x1/CVE-2026-0257 | 2026-06-15 |
| Nuclei | Palo Alto Networks PAN-OS - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-0257 is a high vulnerability (CVSS 7.8) in Palo Alto Networks Cloud Ngfw, published May 13, 2026. CISA lists it as known to be exploited, since May 29, 2026. EUVD reports exploitation since May 29, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.6%, the 99th percentile. No source names a fixed version.