CVE-2026-0257

As of 2026-05-29, CVE-2026-0257 is a CVSS 9.1 (CRITICAL-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 0.1%. Threadlinqs Intelligence tracks 4 threats exploiting it.

Last updated: 2026-05-29

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-565

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• ChocoPoC Campaign: Trojanised PoC Exploits and PyPI Packages Deliver Python RAT Using Mapbox Datasets API as Dead-Drop C2 — HIGH
• ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security Researchers — HIGH
• ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security Researchers — HIGH
• Palo Alto Networks PAN-OS / Prisma Access GlobalProtect Authentication Bypass (CVE-2026-0257) — Active Exploitation, CISA KEV — CRITICAL

References

• https://security.paloaltonetworks.com/CVE-2026-0257

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.