CVE-2026-0257
HIGH CISA KEV EPSS 99.7%
Published May 13, 20261mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 4.0
Published May 13, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
KEV Listed May 29, 2026 1mo ago
KEV Due Jun 1, 2026 29d overdue
Description
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
CISA Known Exploited Overdue 29d
- Added
- May 29, 2026
- Due
- Jun 1, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS Exploit Probability
99.7% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available
Weaknesses 1
CWE-565
Affected Products 191
References 3
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-967325.html
- security.paloaltonetworks.com https://security.paloaltonetworks.com/CVE-2026-0257
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.