CVE-2026-0257, CoreCVE

Back Back to CVE browser

HIGH KEV

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Published May 13, 2026 ·Due Jun 1, 2026

7.8

HIGH

CVSS 4.0

EPSS 96.38%

Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

Panorama and Cloud NGFW are not impacted by these issues.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
- Version
  11.1.0
  Status
  affected
  Constraints
  <11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
- Version
  11.2.0
  Status
  affected
  Constraints
  <11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
- Version
  12.1.0
  Status
  affected
  Constraints
  <12.1.7, 12.1.4-h6
Vendor Palo Alto Networks Product Prisma Access Default
unaffected
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.10-h36
- Version
  11.2.0
  Status
  affected
  Constraints
  <11.2.7-h13

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

unaffected

Version	Status	Constraints
10.2.0	affected	<10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
11.1.0	affected	<11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
11.2.0	affected	<11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
12.1.0	affected	<12.1.7, 12.1.4-h6

Palo Alto Networks

Prisma Access

unaffected

Version	Status	Constraints
10.2.0	affected	<10.2.10-h36
11.2.0	affected	<11.2.7-h13

Remediation

Vendor solution

Note: With this fix, if the firewall is configured to use an authentication override cookie for the GlobalProtect Portal or Gateway, it will regenerate the cookie using a more secure method. Therefore, GP users will need to re-authenticate after a PAN-OS upgrade, even if a valid cookie is present. This is a one time requirement. Once they re-authenticate after the upgrade, the authentication override cookie and its validity will work as they do today.

Metrics

96.38% 0.96382

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.96382

Score over time

May–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	96.38% (0.96382)	99.88th	v5 (v2026.06.15)
Sep 11, 2026	95.16% (0.95156)	99.86th	v5 (v2026.06.15)
Jul 24, 2026	93.91% (0.93905)	99.83th	v5 (v2026.06.15)
Jun 23, 2026	86.68% (0.86678)	99.71th	v5 (v2026.06.15)
Jun 15, 2026	18.58% (0.18583)	96.88th	v5 (v2026.06.15)
Jun 14, 2026	60.45% (0.60447)	98.32th	v4 (v2025.03.14)
Jun 9, 2026	58.79% (0.58788)	98.25th	v4 (v2025.03.14)
Jun 7, 2026	52.85% (0.52850)	98.00th	v4 (v2025.03.14)
Jun 5, 2026	47.85% (0.47850)	97.77th	v4 (v2025.03.14)
Jun 4, 2026	46.45% (0.46453)	97.72th	v4 (v2025.03.14)
Jun 2, 2026	36.34% (0.36344)	97.20th	v4 (v2025.03.14)
May 30, 2026	41.50% (0.41505)	97.47th	v4 (v2025.03.14)
May 14, 2026	0.05% (0.00054)	17.09th	v4 (v2025.03.14)

Weaknesses (1)

CWE-565

References (3)

https://cert-portal.siemens.com/productcert/html/ssa-967325.html
Third Party Advisory
https://security.paloaltonetworks.com/CVE-2026-0257
vendor-advisoryVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257
government-resourceUS Government Resource

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/html/ssa-967325.html		Third Party Advisory
https://security.paloaltonetworks.com/CVE-2026-0257		vendor-advisoryVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257		government-resourceUS Government Resource