Affected Systems

Palo Alto Networks PAN-OS GlobalProtect VPN. Specific affected versions not disclosed in provided data. Impacts corporate networks using GlobalProtect for remote access.

Exploitation Status

Active exploitation confirmed by Palo Alto Networks. Attackers are targeting corporate networks in the wild.

Business Impact

Authentication bypass allows attackers to gain unauthorized VPN access without valid credentials, enabling network infiltration, lateral movement, and potential data exfiltration. Critical risk for organizations relying on GlobalProtect for perimeter security. Immediate patching required to prevent compromise.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Palo Alto Networks security updates for CVE-2026-0257 immediately to all PAN-OS devices running GlobalProtect
  • Review GlobalProtect VPN logs for suspicious authentication patterns, unexpected source IPs, or anomalous session creation
  • Implement temporary compensating controls such as IP allowlisting or additional MFA layers if patching cannot be completed within hours
  • Monitor network traffic from GlobalProtect gateway for lateral movement indicators and unauthorized internal access
  • Conduct threat hunt for indicators of compromise on systems accessed via VPN in the past 30 days