Threat actors began targeting an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS just four days after public disclosure, Rapid7 warns.
Tracked as CVE-2026-0257 (CVSS score of 7.8), the high-severity security defect allows attackers to bypass restrictions and establish VPN connections to vulnerable appliances.
Palo Alto Networks released fixes for the bug on May 13, noting that it affects firewalls with GlobalProtect portal or gateway enabled, under certain configurations.
On Friday, the company updated its advisory to warn that threat actors are exploiting the flaw in the wild, and NIST flagged the issue as critical.
“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company says.
Simultaneously, the US cybersecurity agency CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by June 1.
Palo Alto Networks and CISA did not share details on the observed exploitation, but Rapid7 revealed that threat actors started exploiting CVE-2026-0257 on May 17.
“During the initial investigation, Rapid7 observed a suspicious cookie authentication to the local admin account across multiple customer environments from the same hosting provider, Vultr,” the cybersecurity firm notes.
On May 21, the company says, the same threat actor launched a second wave of attacks from the hosting provider Dromatics Systems.
“In this wave of exploitation, Rapid7 observed VPN IP assignment following the cookie authentication, granting them access to the internal network. At this time, Rapid7 is unable to confirm why VPN assignment occurred only for a subset of exploited customers,” the security firm says.
The threat actor successfully exploited CVE-2026-0257 across multiple environments, probing the authentication bypass using forged cookies. In eight out of ten cases, the cookies were accepted without a full VPN session being established.
Rapid7 has published a proof-of-concept (PoC) script to help organizations identify vulnerable Palo Alto Networks firewalls in their environments. It also released indicators of compromise (IoCs) to help defenders hunt for potential compromises.
Palo Alto Networks included patches for the vulnerability in software updates for PAN-OS 12.1, 11.2, 11.1, and 10.2, and for Prisma Access 11.2.0 and 10.2.0. Organizations are advised to update to a patched iteration as soon as possible.
Related: Exploit Code Published for Critical Flowise RCE Vulnerability
Related: Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks
Related: CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day
Related:Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment
