Cyber threat alert: Ongoing exploitation of PAN-OS CVE-2026-0257 vulnerability

Jun 6, 2026 | Threat Intelligence Research

Active Exploitation of PAN-OS Vulnerability CVE-2026-0257

Threat actors are currently exploiting a vulnerability in PAN-OS identified as CVE-2026-0257, as reported by Palo Alto Networks Unit 42. This security issue, characterized by an authentication bypass affecting the GlobalProtect portal and gateway components, enables unauthorized individuals to initiate VPN connections without proper credentials.

Palo Alto Networks has classified this vulnerability as a significant concern, adding it to the Known Exploited Vulnerability catalog on May 29. Initial observations indicated limited post-access activities, with only a small number of attempts resulting in actual VPN sessions. The identified threat does not currently exhibit lateral movement within networks.

Organizations running vulnerable PAN-OS versions are advised to actively search for indicators of exploitation and initiate incident response protocols if they detect suspicious gateway-connected events. This should include reviewing logs for any successful connections from the specific IP addresses associated with the malicious activity.

Defensive Context

The ongoing exploitation of CVE-2026-0257 raises immediate concerns for organizations utilizing PAN-OS in their VPN infrastructure. Companies that rely heavily on GlobalProtect for secure remote access should prioritize investigating gateway connection logs for unauthorized access attempts, particularly from the listed IOCs. Given that the vulnerability allows bypassing security controls, any organization that uses affected PAN-OS versions needs to be aware of the risks posed by this vulnerability, especially if they manage sensitive information or critical operations over VPN connections.

Why This Matters

This vulnerability presents a tangible risk for enterprises leveraging PAN-OS for VPN services. Unauthorized access could lead to data breaches or other malicious actions if exploited effectively. Organizations in regulated industries or those holding sensitive data are particularly at risk and should take swift action to mitigate exposure.

Defender Considerations

For affected environments, specifically monitor GlobalProtect logs for the provided IP addresses and any connections from unusual host IDs or device names, such as those listed in the article. The initial exploit attempts were seen from a range of IPs, including 23.128.228.6 and 104.207.144.154. As part of a proactive security posture, organizations should implement rigorous logging and monitoring of gateway-connected events as a means of early detection.