CVE-2026-0257

HIGH 7.8 KNOWN EXPLOITED RANSOMWARE PoC CATALOGUED DETECTION TEMPLATE ALL-YEARS

Published 2026-05-13 · Last modified 2026-10-15 · palo_alto · NVD: Analyzed

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-05-29, linked to ransomware campaigns. Patch or mitigate now.

Exploitation likelihood

95.0%chance of exploitation in 30 days · 100th percentile

● In CISA KEV (2026-05-29)● Catalogued PoC◆ SSVC: exploitation active, automatable no

Impact if exploited

7.8CVSS 4.0 · HIGH · CNA

ConfidentialityLow
IntegrityNone
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Detection templates

Detection checks are listed separately from PoCs.

Nuclei detection template

Resource commands

nuclei -id CVE-2026-0257 -u https://TARGETDetection template — review its checks and affected versions before use.

curl -s https://vulnpedia.com/cve/CVE-2026-0257/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T06:59:15.268Z

Affected

Vendors Palo Alto Networks Siemens Paloaltonetworks

Products Cloud Ngfw Pan Os Prisma Access Ruggedcom Ape1808 Ruggedcom Ape1808 Firmware

Weakness (CWE)

CWE-565: Reliance on Cookies without Validation and Integrity Checking

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red

References and research data (JSON)

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

7 candidates

https://github.com/sfewer-r7/CVE-2026-0257
Proof-of-concept script to leverage the PAN-OS GlobalProtect authentication bypass CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-09-30T18:24:44Z
https://github.com/akashsingh0454/CVE-2026-0257-PoCPoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-06-03T14:55:43Z
https://github.com/HORKimhab/CVE-2026-0257
CVE-2026-0257 - PAN-OS
PoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-05-31T07:51:52Z
https://github.com/0xBlackash/CVE-2026-0257
CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-06-15T14:09:27Z
https://github.com/tushargurav28/CVE-2026-0257
Palo Alto Networks PAN-OS contains an authentication bypass caused by flaws in the GlobalProtect portal and gateway, letting attackers establish unauthorized VPN connections, exploit requires network access to the portal or gateway.
PoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-06-15T14:53:13Z
https://github.com/grayxploit/CVE-2026-0257
GrayXploit Security research and defensive team validate this toolkit for CVE-2026-0257 (PAN-OS GlobalProtect Authentication Bypass). Includes vulnerability assessment, detection guidance, technical analysis, indicators of compromise (IOCs), and remediation validation resources for security teams and defenders.
PoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-10-13T05:23:43Z
https://github.com/Ez4rd1x1/CVE-2026-0257
testing
PoC-in-GitHub · CVE-2026-0257
PoC-in-GitHub · CVE-2026-0257 · Updated 2026-06-15T06:51:51Z

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

VulnCheck KEV · 2026-05-29T00:00:00Z
Source guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source ransomware assessment: Known
VulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
VulnCheck KEV · 2026-05-29T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · CVE-2026-0257
VulnCheck KEV · CVE-2026-0257
VulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-05-30T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-06-05T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-06-11T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-06-24T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-07-09T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-07-20T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-07-27T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-08-07T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-09-24T00:00:00ZVulnCheck KEV · CVE-2026-0257
VulnCheck KEV · 2026-10-21T00:00:00ZVulnCheck KEV · CVE-2026-0257

Known Affected Software Configurations

Vendor	Product	Version range
Paloaltonetworks	Pan Os	< 10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.7
Paloaltonetworks	Pan Os	10.2.8
Paloaltonetworks	Pan Os	10.2.9
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.10
Paloaltonetworks	Pan Os	10.2.11
Paloaltonetworks	Pan Os	10.2.12
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.13
Paloaltonetworks	Pan Os	10.2.14
Paloaltonetworks	Pan Os	10.2.15
Paloaltonetworks	Pan Os	10.2.16
Paloaltonetworks	Pan Os	10.2.16
Paloaltonetworks	Pan Os	10.2.16
Paloaltonetworks	Pan Os	10.2.16
Paloaltonetworks	Pan Os	10.2.17
Paloaltonetworks	Pan Os	10.2.18
Paloaltonetworks	Pan Os	10.2.18
Paloaltonetworks	Pan Os	10.2.18
Paloaltonetworks	Pan Os	11.1.0
Paloaltonetworks	Pan Os	11.1.1
Paloaltonetworks	Pan Os	11.1.2
Paloaltonetworks	Pan Os	11.1.3
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.4
Paloaltonetworks	Pan Os	11.1.5
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.6
Paloaltonetworks	Pan Os	11.1.7
Paloaltonetworks	Pan Os	11.1.7
Paloaltonetworks	Pan Os	11.1.7
Paloaltonetworks	Pan Os	11.1.7
Paloaltonetworks	Pan Os	11.1.8
Paloaltonetworks	Pan Os	11.1.9
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.10
Paloaltonetworks	Pan Os	11.1.11
Paloaltonetworks	Pan Os	11.1.12
Paloaltonetworks	Pan Os	11.1.13
Paloaltonetworks	Pan Os	11.1.13
Paloaltonetworks	Pan Os	11.1.13
Paloaltonetworks	Pan Os	11.1.13
Paloaltonetworks	Pan Os	11.1.14
Paloaltonetworks	Pan Os	11.2.0
Paloaltonetworks	Pan Os	11.2.1
Paloaltonetworks	Pan Os	11.2.2
Paloaltonetworks	Pan Os	11.2.3
Paloaltonetworks	Pan Os	11.2.4
Paloaltonetworks	Pan Os	11.2.4
Paloaltonetworks	Pan Os	11.2.4
Paloaltonetworks	Pan Os	11.2.4
Paloaltonetworks	Pan Os	11.2.4

Showing 120 of 162 configuration entries. Full list on NVD.

All CVSS metrics

HIGH 7.8 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
HIGH 7.8 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red
CRITICAL 9.1 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Advisories

https://security.paloaltonetworks.com/CVE-2026-0257 vendor-advisoryVendor AdvisoryKEV reportCVE record · palo_alto · Updated 2026-05-29T17:20:05.451Z
NVD · CVE-2026-0257 · Updated 2026-06-17T10:10:37.953
VulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257 government-resourceUS Government ResourceCVE record · CISA-ADP · Updated 2026-05-30T03:55:17.629Z
NVD · CVE-2026-0257 · Updated 2026-06-17T10:10:37.953
https://cert-portal.siemens.com/productcert/html/ssa-967325.html Third Party AdvisoryCVE record · siemens-SADP · Updated 2026-10-15T01:11:26.182Z
NVD · CVE-2026-0257 · Updated 2026-06-17T10:10:37.953
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30104 ADVISORYEUVD · EUVD-2026-30104
https://vulncheck.com/kev ADVISORYVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z

Technical & other

https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b7fb4ba7-d51e-416b-b7e5-edb69fed283f KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/ KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://t.me/ctinow/251048 KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://arcticwolf.com/resources/blog/arctic-wolf-observes-increase-in-palo-alto-networks-globalprotect-authentication-bypass-exploitation-via-cve-2026-0257/ KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://fortiguard.fortinet.com/outbreak-alert/pan-os-globalprotect-auth-bypass KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://hunt.io/blog/eastern-europe-malicious-infrastructure-report KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/ KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://cyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://www.recordedfuture.com/blog/july-2026-cve-landscape KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://socradar.io/blog/operation-master-intrusion-monetization-pipeline/ KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://www.group-ib.com/blog/stray-cat-network-edge/ KEV reportVulnCheck KEV · CVE-2026-0257 · Updated 2026-05-29T00:00:00Z
https://vulncheck.com/xdb/67bc455a960f XDB catalogueVulnCheck KEV · 67bc455a960f · Updated 2026-05-29T00:00:00Z
https://github.com/sfewer-r7/CVE-2026-0257 XDB repositoryVulnCheck KEV · 67bc455a960f · Updated 2026-05-29T00:00:00Z
https://vulncheck.com/xdb/96671be61df1 XDB catalogueVulnCheck KEV · 96671be61df1 · Updated 2026-05-29T00:00:00Z
https://github.com/bolubey/CVE-2026-0257 XDB repositoryVulnCheck KEV · 96671be61df1 · Updated 2026-05-29T00:00:00Z
https://vulncheck.com/xdb/6a7d3e73b64c XDB catalogueVulnCheck KEV · 6a7d3e73b64c · Updated 2026-05-29T00:00:00Z
https://github.com/tushargurav28/CVE-2026-0257 XDB repositoryVulnCheck KEV · 6a7d3e73b64c · Updated 2026-05-29T00:00:00Z
https://vulncheck.com/xdb/8929a677e400 XDB catalogueVulnCheck KEV · 8929a677e400 · Updated 2026-05-29T00:00:00Z
https://github.com/grayxploit/CVE-2026-0257 XDB repositoryVulnCheck KEV · 8929a677e400 · Updated 2026-05-29T00:00:00Z
https://vulncheck.com/xdb/3e3a9e393003 XDB catalogueVulnCheck KEV · 3e3a9e393003 · Updated 2026-05-29T00:00:00Z
https://github.com/Ez4rd1x1/CVE-2026-0257 XDB repositoryVulnCheck KEV · 3e3a9e393003 · Updated 2026-05-29T00:00:00Z

Sources: NVD · CVE.org · All sources and attribution · EPSS