[KEV] CVE-2026-0257 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-0257 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS that allows unauthenticated attackers to establish unauthorized VPN connections by circumventing security controls.

Technical Detail

The flaw resides in the VPN authentication handling within PAN-OS, where an attacker can bypass credential verification or session validation mechanisms to initiate a VPN tunnel without legitimate credentials. Successful exploitation grants the attacker network-level access equivalent to an authenticated VPN user, potentially enabling lateral movement into protected network segments. The precise triggering mechanism has not been fully disclosed publicly, but the operational exploit maturity indicates the technique is reliable and reproducible in real-world conditions.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on May 29, 2026. The exploit maturity is rated Operational, meaning a functional and reliable exploit exists and is being used in active attacks rather than existing only as a proof-of-concept. Organizations running affected PAN-OS versions should treat this as an immediate threat requiring urgent remediation.

Who Is Targeting This

No specific threat actor attribution has been confirmed or reported at this time. Given the nature of the vulnerability, which provides direct unauthorized VPN access to enterprise networks, it presents a high-value target for espionage-motivated actors and ransomware operators alike, though no named groups have been formally associated with exploitation of this CVE.

What To Do

Apply the relevant PAN-OS patch from Palo Alto Networks immediately. Per CISA's Known Exploited Vulnerabilities catalog requirements, federal agencies under BOD 22-01 must remediate this vulnerability by the deadline associated with the May 29, 2026 listing, which typically allows 14 days from the date added. Organizations should consult the Palo Alto Networks security advisory for specific affected version ranges and fixed releases. As an interim measure, restrict VPN gateway exposure to known IP ranges where operationally feasible, enable enhanced logging on GlobalProtect and VPN authentication events, and review VPN session logs for anomalous or unexpected connection sources dating back at least 30 days to identify potential prior compromise.