Active operation of CVE 2026 0257 in PAN OS and GlobalProtect opens doors to the internal network

Palo Alto Networks has confirmed that an authentication vulnerability in PAN-OS and Prisma Access, registered as CVE-2026-0257(CVSS 7.8), is being actively exploited to establish unauthorized VPN connections through GlobalProtect. The specific feature at risk is the so-called "authentication override" when it is activated on portals or gateways and there is a specific combination of certificates; under these conditions the attackers can draw the controls and get valid VPN sessions to the internal network.

The important thing, beyond the CVE's medium-high score, is the confirmation of exploitation in real environments: Rapid7 documented successful commitments from May 17 and a second wave on May 21 attributed to the same actor, and Palo Alto Networks updated its notice by detecting limited attempts on unpatched devices. In at least two reported cases, the operation allowed the allocation of VPN IP after handling the authentication cookie and therefore access to domestic resources, although no follow-up activities have so far been reported in these particular environments.

This incident fits into a broader trend: border applications and endpoints management solutions are increasingly targeted for attack chains aimed at obtaining initial access and deploying credentials thieves. For example, the recent operation of a failure in FortiClient EMS (CVE-2026-35616, CVSS 9.1) has been used to distribute the EKZ Infosealer credentials thief malware, which emphasizes that compromised VPN access may be the first step for exfiltration campaigns and lateral movement. The NVD database is available for official references on these EQs: CVE-2026-0257 and CVE-2026-35616 as well as the supplier's communications on its safety portal Palo Alto Networks Security Advisory.

The implications for an organisation with affected devices are clear: an authentication bypass on a border VPN implies direct risk to the confidentiality and integrity of the internal network. Even if the actor does not perform additional activity after obtaining the session, the mere ability to establish a VPN allows to explore internal services, test credentials, or deploy recognition tools that facilitate subsequent attacks.

Immediate practical recommendations should prioritize mediation and detection. In order of urgency, organizations must apply the official supplier patches as soon as they are available and validated; if this cannot be done immediately, it must be disable the authentication override function or, as an alternative mitigation, generate a new certificate that is used exclusively for the override function and remove the previous certificate from any general use. In addition, it is critical to review GlobalProtect records to identify unusual sessions, correlate VPN IP assignments with legitimate login and look for unauthorized access signs.

From a broader defensive point of view, this type of incident forces to strengthen controls: implement robust multifactor authentication for VPN access, network segmentation to limit what a compromised session can achieve, zero-confidence policies in remote access and detection capabilities in endpoints and networks to identify abnormal behavior after a session. In addition, response teams should have procedures to isolate potentially compromised devices, preserve evidence and perform forensic analysis if side activity or exfiltration is detected.

For those responsible for safety and operation the lesson is double: on the one hand, to maintain an agile patching program and on the other, to assume that vulnerabilities in edge devices will be exploited quickly, so that compensatory mitigation, centralized telemetry and response exercises are essential. Finally, transparent reporting to the rest of the organization on the need for a rotation of credentials and on the mitigation measures applied helps to reduce the exposure window and coordinate an effective response.