This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Palo Alto PAN-OS fixes an actively exploited vulnerability
Palo Alto Networks fixes an actively exploited vulnerability in PAN-OS [1][2]. Individual fixed versions of the product: PAN-OS 12.1 - 12.1.4-h6, 12.1.7 PAN-OS 11.2 - 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 PAN-OS 11.1 - 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 PAN-OS 10.2 - 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 Prisma Access* - 11.2.0 - 11.2.7-h13 Prisma Access* - 10.2.0 - 10.2.10-h36 *The Prisma Access cloud service is updated continuously for all customers according to a planned schedule.
An unauthenticated remote attacker can bypass security restrictions in the PAN-OS GlobalProtect Portal and Gateway software and establish an unauthorized VPN connection. The vulnerability is exploitable if generating or accepting cookies for “authentication override” is enabled in the GlobalProtect Portal (or Gateway) settings and the same certificate that secures HTTPS access to the given interface is used to encrypt them [1]. Please note that applying the update will invalidate existing cookies and a one-time re-authentication will be required. If an immediate update to the fixed version is not possible, the temporary mitigation procedure is described at [1]. A detailed analysis of the vulnerability can be found at [3] and a PoC at [4].
The vulnerability is present in products:
- PAN-OS; >=10.2.7, <10.2.7-h34; >=10.2.10, <10.2.10-h36; >=10.2.13, <10.2.13-h21; >=10.2.16, <10.2.16-h7; >=10.2.18, <10.2.18-h6; >=11.1.4, <11.1.4-h33; >=11.1.6, <11.1.6-h32; >=11.1.7, <11.1.7-h6; >=11.1.10, <11.1.10-h25; >=11.1.13, <11.1.13-h5; >=11.2.4, <11.2.4-h17; >=11.2.7, <11.2.7-h14; >=11.2.10, <11.2.10-h7; >=12.1.4, <12.1.4-h6;
- Prisma Access; >=10.2.10, <10.2.10-h36; >=11.2.7, <11.2.7-h13;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
More information:
- CVE-2026-0257 at cve.org, NVD
- CWE-565: Reliance on Cookies without Validation and Integrity Checking at cwe.mitre.org
The vulnerability was publicly disclosed 13. 5. 2026.
Links
- [1] https://security.paloaltonetworks.com/CVE-2026-0257
- [2] https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog
- [3] https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/
- [4] https://github.com/sfewer-r7/CVE-2026-0257
By CESNET, z.s.p.o. Michaela Ručková on 1. 6. 2026.