Reported by 9 outlets

Timeline

1. original reporting

   PAN-OS CVE-2026-0257 CISA KEV — GlobalProtect Authentication Bypass Actively Exploited, Rapid7 Confirms Two Attack Waves

   rapid7.com · 137d ago · May 30th, 2026

   CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, confirming active in-the-wild exploitation of an authentication bypass in Palo Alto Networks PAN-OS and Prisma Access. The flaw allows a remote unauthenticated attacker to forge authentication override cookies and establish unauthorized VPN connections through the GlobalProtect gateway — critical for any organization running internet-facing GlobalProtect appliances.

   Rapid7 MDR documented two distinct exploitation waves. The first, on May 17, originated from Vultr hosting (IP: 104.207.144.154, machine name: GP-CLIENT, spoofed MAC: aa:bb:cc:dd:ee:ff) targeting local admin accounts via cookie authentication. The second wave on May 21 originated from Dromatics Systems (IPs: 146.19.216.119/120/125, machine name: DESKTOP-GP01) using SAML authentication profiles — with some victims receiving full VPN IP assignments granting internal network access. The consistent spoofed MAC across both waves strongly suggests a single threat actor.

   The vulnerability mechanics: The GlobalProtect service (/usr/local/bin/gpsvc) decrypts authentication override cookies using the certificate's private key but performs zero signature verification on the decrypted content. When the certificate used for cookie encryption is shared with another feature (e.g., the HTTPS service), an attacker can retrieve the public key from the TLS certificate, forge valid cookies with arbitrary usernames, and bypass authentication entirely. The auth override feature is not enabled by default, but once enabled with certificate reuse, exploitation is trivial.

   Rapid7 released a public Python PoC script that iterates through the certificate chain and tests each public key. Affected: PAN-OS 10.2.x–12.1.x and Prisma Access. Patches available; 8 of 10 impacted Rapid7 MDR customers experienced authentication probes rather than full VPN establishment.

   ---

2. update from security.paloaltonetworks.com

   CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (Palo Alto Networks vendor advisory)

   security.paloaltonetworks.com · 154d ago · May 13th, 2026

   Palo Alto Networks published the vendor advisory on May 13, 2026, disclosing an authentication bypass in the GlobalProtect portal and gateway (CWE-565), discovered internally, affecting PAN-OS 10.2.x through 12.1.x and Prisma Access, with Panorama and Cloud NGFW unaffected. It originally carried a CVSSv4 base score of 4.7 (Medium) and listed exposure as firewalls with authentication override cookies enabled plus a specific certificate configuration, with fixes across ten PAN-OS branches and two mitigations: use a dedicated certificate for authentication override, or disable the feature. The advisory timeline shows exploitation-status and fix-timeline updates on May 14 through May 29, when the exploitation status was changed and the score rose to CVSSv4 7.8 HIGH with Exploit Maturity: ATTACKED.

3. update from rapid7.com

   Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) — original researcher disclosure

   rapid7.com · 138d ago · May 29th, 2026

   Rapid7's Emergent Threat Response post, initially published May 29, 2026, is the original researcher disclosure: MDR identified successful exploitation across numerous customers with the earliest observed exploitation on May 17, 2026, four days before the May 29 PoC release and KEV listing. Reverse engineering of /usr/local/bin/gpsvc showed main_DecryptAppAuthCookie decrypts portal-userauthcookie and portal-prelogonuserauthcookie values submitted to /ssl-vpn/login.esp and trusts the plaintext with no signature verification, so anyone holding the public key of a certificate shared with the HTTPS service can forge cookies.

4. update from bleepingcomputer.com

   CVE-2026-0257 — Palo Alto Networks Raises GlobalProtect Severity to High, Confirms Limited Exploit Attempts

   bleepingcomputer.com · 136d ago · May 31st, 2026

   Palo Alto Networks updated its advisory on Friday to raise CVE-2026-0257 from Medium to High severity, confirming that the PAN-OS GlobalProtect authentication bypass — which allows forgery of authentication override cookies for unauthorized VPN access — is now being exploited in limited attacks against unpatched devices. Recommended action: patch unpatched GlobalProtect gateways immediately; disable authentication override or use separate certificates if patching is delayed.

5. update from japancyberwatch.com

   Japan's Digital Agency was breached through a VPN flaw that was public before the attack. Data on ~246,000 officials and contractors may be

   japancyberwatch.com · 18d ago · September 25th, 2026

   Japan's Digital Agency was breached through a VPN flaw that was public before the attack. Data on ~246,000 officials and contractors may be

   via Mastodon https://japancyberwatch.com/articles/japan-digital-agency-gss-breach-2026

6. update from cyberpress.org

   Operation Master Hackers Exploit GlobalProtect Flaw to Launch 2.4 Million Fraud Messages

   cyberpress.org · 15d ago · September 28th, 2026

   Hackers behind Operation Master exploited a Palo Alto Networks GlobalProtect authentication bypass to enter corporate networks, steal billing data and run large-scale invoice scams. The group then used stolen customer details to make fraudulent bills look convincing. The vulnerability did not, by itself, send the fraud messages; it was one entry point in a wider operation that also used web application attacks and stolen accounts. GlobalProtect Flaw Fuels Fraud According to SOCRadar, the operator scanned roughly 277.5 million addresses across 22 logged runs. Automated tools filtered exposed gateways, while manual review produced a priority list covering 81 organizations. Recovered VPN output included assigned addresses, DNS settings and routes, which researchers said confirmed working unauthorized sessions. The attacker also used SQL injection against web applications. In some cases, access to a database led to command execution through SQL Server’s xp_cmdshell feature. Operation Master timeline (Source: socradar) SOCRadar confirmed stolen data from at least nine database instances and recovered 24,558 debtor records from an energy-billing syst

7. update from gbhackers.com

   Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks

   gbhackers.com · 15d ago · September 28th, 2026

   “Operation Master,” an end-to-end cybercrime operation that combined GlobalProtect VPN exploitation, web-application attacks, credential theft, data monetization, and an industrial-scale invoice-fraud platform. The campaign illustrates how enterprise intrusions can be converted into persistent, localized financial fraud operations rather than ending with data theft or ransomware. The operation exploited CVE-2026-0257, an authentication-bypass vulnerability affecting Palo Alto […] The post Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

8. mentioned by cyberupdates365.com

   Ransomware Actors Exploit Palo Alto GlobalProtect Flaw for VPN Access Attackers are exploiting CVE-2026-0257 in Palo Alto Networks GlobalPro

   cyberupdates365.com · 3d ago · October 11th, 2026

9. mentioned by thecybersecguru.com

   Ransomware Actors Weaponize Palo Alto GlobalProtect Authentication Bypass for Stealthy VPN Access Palo Alto GlobalProtect CVE-2026-0257 is b

   thecybersecguru.com · 2d ago · October 11th, 2026

10. mentioned by thecybersecguru.com

    🚨 Ransomware gangs are exploiting a flaw in Palo Alto Networks GlobalProtect VPN to bypass authentication and gain unauthorized network acce

    thecybersecguru.com · 2d ago · October 11th, 2026

11. update from gbhackers.com

    Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability

    gbhackers.com · 1d ago · October 12th, 2026

    ReliaQuest has identified multiple threat groups leveraging this flaw, including the Qilin and Settra ransomware operations.

12. mentioned by zubiqo.com

    Ransomware groups are exploiting an authentication bypass (CVE-2026-0257) in Palo Alto Networks GlobalProtect to establish unauthorized VPN

    zubiqo.com · 1d ago · October 12th, 2026

13. mentioned by security.paloaltonetworks.com

    A GlobalProtect flaw patched in May is working for ransomware crews. ReliaQuest has Qilin and Settra both using CVE-2026-0257, an authentica

    security.paloaltonetworks.com · 1d ago · October 12th, 2026