CVE-2026-0257
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
- EPSS probability
- 93.91%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-565
- Published
- 2026-05-13
- Last modified
- 2026-07-14
Affected products
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Palo Alto Networks Prisma Access
Weakness type
Related vulnerabilities
- CVE-2026-85181 — CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
- CVE-2026-75757 — AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
- CVE-2026-53871 — Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie
- CVE-2026-8337 — Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys
- CVE-2026-39963 — Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain
- CVE-2026-39324 — Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
- CVE-2026-5130 — Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
- CVE-2014-125112 — Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution