MSRXVulnerabilities / CVE-2026-0257
CVE-2026-0257
Published 2026-05-13 · Analyzed
CVE-2026-0257
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-29, with a fix-by date of 2026-06-01. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
7.8 HIGH
CVSS 4.0 · CNA · paloaltonetworks.com
CVSS 4.0 · CNA · paloaltonetworks.com
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
Scores
7.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:RedCNA · paloaltonetworks.com
Affected products
- paloaltonetworks pan-os: < 10.2.7; 159 specific releases listed in NVD
- paloaltonetworks prisma access: all versions
- siemens ruggedcom ape1808 firmware: all versions
Weakness: CWE-565
3 references (advisories, patches, write-ups)
- https://security.paloaltonetworks.com/CVE-2026-0257 · Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-967325.html · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257 · US Government Resource
Sources: NVD, CVE.org. Missing ones did not answer or have no record yet.