{"id":"CVE-2026-0257","aliases":["EUVD-2026-30104","GHSA-jqxw-84hx-6qj5"],"status":"published","title":"PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities","description":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","severity":{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.95642,"percentile":0.99872,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-565"],"published":"2026-05-13T18:15:10Z","modified":"2026-10-26T14:10:00Z","kev":{"date_added":"2026-05-29","due_date":"2026-06-01","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2026-05-29"},{"source":"kev","since":"2026-05-29"}],"exploits":[{"source":"pocgithub","id":"akashsingh0454/CVE-2026-0257-PoC","title":"akashsingh0454/CVE-2026-0257-PoC","date":"2026-05-29","url":"https://github.com/akashsingh0454/CVE-2026-0257-PoC"},{"source":"pocgithub","id":"sfewer-r7/CVE-2026-0257","title":"sfewer-r7/CVE-2026-0257","date":"2026-05-29","url":"https://github.com/sfewer-r7/CVE-2026-0257"},{"source":"pocgithub","id":"HORKimhab/CVE-2026-0257","title":"HORKimhab/CVE-2026-0257","date":"2026-05-30","url":"https://github.com/HORKimhab/CVE-2026-0257"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-0257","title":"ashrafzaryouh/CVE-2026-0257","date":"2026-05-30","url":"https://github.com/ashrafzaryouh/CVE-2026-0257"},{"source":"pocgithub","id":"tushargurav28/CVE-2026-0257","title":"tushargurav28/CVE-2026-0257","date":"2026-06-03","url":"https://github.com/tushargurav28/CVE-2026-0257"},{"source":"pocgithub","id":"grayxploit/CVE-2026-0257","title":"grayxploit/CVE-2026-0257","date":"2026-06-10","url":"https://github.com/grayxploit/CVE-2026-0257"},{"source":"pocgithub","id":"Ez4rd1x1/CVE-2026-0257","title":"Ez4rd1x1/CVE-2026-0257","date":"2026-06-15","url":"https://github.com/Ez4rd1x1/CVE-2026-0257"},{"source":"nuclei","id":"CVE-2026-0257","title":"Palo Alto Networks PAN-OS - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-0257.yaml"}],"products":[{"vendor":"palo alto networks","product":"cloud ngfw"},{"vendor":"palo alto networks","product":"pan-os"},{"vendor":"palo alto networks","product":"prisma access"},{"vendor":"paloaltonetworks","product":"pan-os"},{"vendor":"paloaltonetworks","product":"prisma_access"},{"vendor":"siemens","product":"ruggedcom ape1808"},{"vendor":"siemens","product":"ruggedcom_ape1808_firmware"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0257","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257","tags":["government-resource","US Government Resource"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-967325.html","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0257"},{"url":"https://github.com/advisories/GHSA-jqxw-84hx-6qj5"}],"sources":{"cve":[{"id":"CVE-2026-0257","title":"PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities","description":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","status":"published","published":"2026-05-13T18:15:10.172Z","modified":"2026-10-15T01:11:26.182Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red","level":"high","assessor":"cna"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-30104","description":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","status":"published","published":"2026-05-13T18:15:10Z","modified":"2026-10-15T01:11:26Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red","level":"high"}],"exploited_since":"2026-05-29","updated_at":"2026-11-02T17:27:06.951216Z"}],"ghsa":[{"id":"GHSA-jqxw-84hx-6qj5","title":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto...","description":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","status":"published","published":"2026-05-13T21:32:05Z","modified":"2026-06-09T12:32:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":4.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T15:08:40.238392Z"}],"kev":[{"id":"CVE-2026-0257","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","description":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.","cwes":["CWE-565"],"kev":{"date_added":"2026-05-29","due_date":"2026-06-01","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-0257","description":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","status":"published","published":"2026-05-13T19:17:01.04Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-565"],"updated_at":"2026-11-02T14:12:19.020465Z"}]}}