Critical Palo Alto firewall flaw CVE-2026-0257 exploited

Cybersecurity firm Rapid7 has reported active, limited exploitation of a critical authentication bypass vulnerability in Palo Alto Networks' firewalls, allowing attackers to establish unauthorized VPN connections into corporate networks. The vulnerability, identified as CVE-2026-0257, was originally patched by Palo Alto on May 13, but attempts to exploit unpatched systems have been observed.

The flaw affects the GlobalProtect portal and gateway components within Palo Alto’s PAN-OS software, which is used on both physical and virtual firewalls, as well as the cloud-based Prisma Access service. It enables a remote, unauthenticated attacker to bypass security restrictions. Exploitation requires a specific configuration: the authentication override cookie feature must be enabled, and the same digital certificate must be used for both the HTTPS service and the cookie encryption. In such cases, an attacker can retrieve the public key from the device’s HTTPS service and forge a valid authentication cookie, which the firewall accepts without performing proper signature verification.

Rapid7’s Managed Detection and Response team first observed exploitation attempts on May 17, with...