Palo Alto Networks PAN-OS GlobalProtect VPN Flaw Actively Exploited

Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, a high-severity authentication bypass vulnerability (CVSS 7.8) affecting the GlobalProtect VPN portal and gateway components of PAN-OS software. An unknown threat actor has been leveraging the flaw to bypass security controls and establish unauthorized VPN connections, with initial in-the-wild activity first detected on May 17, 2026. According to the company, no post-access lateral movement has been observed so far, and only a small fraction of probed devices successfully established VPN sessions, generating corresponding gateway-connected events.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies remediate the flaw by June 1, 2026. Palo Alto Networks has published a set of indicators of compromise tied to the campaign, including IP addresses such as 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, and 202.144.192[.]47, along with associated hostnames (WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT) and MAC addresses. Security teams can investigate these indicators using a WHOIS lookup to map infrastructure and a port scanner to verify GlobalProtect gateway exposure across their perimeter.

Administrators are strongly urged to audit GlobalProtect logs for successful gateway-connected events matching hard-coded client configuration values from the public proof-of-concept exploit, specifically an endpoint_os_version of "Microsoft Windows 10 Pro 64-bit" paired with an empty source_user_info.domain field. Organizations should also run a privacy checkup to evaluate overall VPN exposure and review whether their PAN-OS appliances are running vulnerable builds. With exploitation underway and the identity of the threat actor still unknown, timely patching and IoC-driven log review remain the most effective defensive measures.