# CVE-2026-0257: Palo Alto Networks PAN-OS auth bypass in GlobalProtect

Source: https://junglewise.ai/threats/cve-2026-0257-palo-alto-networks-pan-os-auth-bypass-in-globalprotect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-0257 · Severity: critical · CVSS 4.7 · Exploited in the wild · Published 2026-05-13

Palo Alto Networks PAN-OS, the operating system used in enterprise firewalls and security appliances, contains a vulnerability that allows attackers to bypass authentication. This could allow an unauthorized user to gain administrative access to the device, potentially leading to full control over network traffic and security policies. CISA has confirmed this vulnerability is being actively exploited in the wild.

Technologies: [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0257 exploited in the wild?** Yes. CVE-2026-0257 is known to be exploited in the wild, first recorded on 29 May 2026. Treat it as urgent.

**How severe is CVE-2026-0257?** Critical severity, with a CVSS score of 4.7, published 13 May 2026.

**Which products and versions are affected?** Palo Alto Networks Prisma Access 11.2.0 < 11.2.7-h13, 10.2.0 < 10.2.10-h36.

**Is there a fix for CVE-2026-0257?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0257 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-0257?** Check whether you run Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in Palo Alto Networks PAN-OS. While specific technical root causes (such as improper validation or logic errors) are not detailed in the CISA advisory, the flaw allows a remote attacker to bypass security controls. This vulnerability is significant as it affects the core operating system of network security appliances. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Users are advised to follow vendor guidance for patching and remediation.

## Affected products

- Palo Alto Networks PAN-OS

## Timeline

- 2026-05-29: advisory: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog.
- 2026-05-29: kev added

## References

- [https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog](https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog)

## Related threats

- [Palo Alto Networks PAN-OS information disclosure via dataplane interface](https://junglewise.ai/threats/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan)
- [Palo Alto Networks PAN-OS buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS privilege escalation in GlobalProtect](https://junglewise.ai/threats/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS GlobalProtect authorization bypass](https://junglewise.ai/threats/cve-2026-0325-an-authorization-bypass-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS GlobalProtect session hijacking](https://junglewise.ai/threats/cve-2026-0319-an-improper-input-handling-vulnerability-in-the-globalprotect)