Palo Alto Networks’ Unit 42 said on October 19 that it is observing active exploitation of CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS that lets a remote, unauthenticated attacker open an unauthorized VPN connection on appliances with specific configurations. The flaw was already in the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, having been added on May 29, 2026, according to the Canadian Centre for Cyber Security.
The Unit 42 threat brief, which carries a further update timestamp of October 20, attributes the activity to an unidentified threat actor and includes indicators of activity and mitigation recommendations. The California Cybersecurity Integration Center (Cal-CSIC) describes the exploitation so far as limited in scale, aimed at unpatched devices without mitigations in place.
Who is affected
Palo Alto Networks’ advisory, dated May 13, 2026, scopes the flaw to GlobalProtect portal and gateway configurations on PAN-OS 10.2, 11.1, 11.2 and 12.1, plus Prisma Access 10.2 and 11.2. Panorama and Cloud Next-Generation Firewall (NGFW) are not affected.
The bug is only exploitable under two conditions, the vendor said: the Authentication Override feature must be enabled, and the certificate used to encrypt and decrypt authentication override cookies must be reused with another feature or context. Organizations that do not use Authentication Override, or that already use a dedicated certificate for it, are not exposed through this path.
Fixed versions
The advisory and aligned government guidance list the following fixed hotfix releases:
- PAN-OS 12.1.4-h6 and 12.1.7
- PAN-OS 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 and 11.2.12
- PAN-OS 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15
- PAN-OS 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6
- Prisma Access 11.2.7-h13 and later, and 10.2.10-h36 and later
Unsupported PAN-OS releases must be upgraded to a supported fixed version, per the vendor’s guidance.
What to do
Beyond patching, Palo Alto Networks recommends two mitigations for administrators who cannot immediately upgrade: disable the Authentication Override feature in GlobalProtect portal and gateway configurations, or generate a dedicated certificate used exclusively for authentication override cookies. Deepwatch’s August 7 write-up likewise calls the hotfixes the most effective measure and repeats both configuration changes.
The Unit 42 brief asks organizations with GlobalProtect-exposed systems to review the indicators of activity it publishes and to watch for anomalous VPN connections.
Severity and scoring
The National Vulnerability Database (NVD) entry lists a CVSS version 4.0 base score of 7.8, rated High. The Cyber Security Agency of Singapore’s July 30 alert characterizes the flaw as critical under CVSS v3.1 with a score of 9.1, a difference that reflects the two scoring systems and configurations.
According to Rapid7, Palo Alto Networks initially rated the vulnerability as medium severity and later raised its CVSS v4 score from 4.7 to 7.8.
What is still unknown
As of October 20, no public source attributes the exploitation to a named actor or describes the victims beyond the references to “limited exploitation attempts” and the KEV listing. Public advisories also do not tie any confirmed data breach or exfiltration incident to the flaw, and no victim counts or sector breakdowns have been released. CISA’s bulletin flags the vulnerability as a significant risk to the federal enterprise, but the specific remediation deadline for agencies under its binding operational directive is not spelled out in the public summaries.
2 Responses