Active exploitation of Palo Alto Networks PAN-OS GlobalProtect vulnerability (heise.de)

• CVE-2026-0257: authentication bypass in PAN-OS GlobalProtect, CVSS 7.8
• CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 29, 2026
• Rapid7 observed two attack waves starting May 17, 2026

"CISA and Palo Alto Networks warn of active attacks exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect. The vulnerability allows attackers to bypass security measures and establish unauthorized VPN connections. Rapid7 observed two attack waves since May 17, 2026. Patches are available for affected versions."