Palo Alto Networks has disclosed that it has detected "active exploitation" of a recently identified PAN-OS vulnerability by an unidentified threat actor, enabling unauthorized access to GlobalProtect portals.
The specific vulnerability is CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw impacting the portal and gateway elements of PAN-OS software, which could be leveraged by malicious actors to establish VPN connections.
The network security firm stated that the security flaw could be used by a malicious actor to circumvent security measures and initiate VPN connections.
The vulnerability has been exploited in the wild in limited attacks, with initial activity first noticed on May 17, 2026. It remains unclear who is responsible for the exploitation attempts.
"As of now, no post-access behavior or lateral movement has been detected," Palo Alto Networks said. "Only a small fraction of the probed devices successfully established VPN sessions, resulting in gateway-connected events."
The company has also released indicators of compromise (IoCs) related to the activity -
IP addresses - 23.128.228[.]6 104.207.144[.]154 146.19.216[.]119 146.19.216[.]120 146.19.216[.]125 179.43.172[.]213 185.195.232[.]139 198.12.106[.]60 202.144.192[.]47
23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47
Host Names and MAC Addresses - aa:bb:cc:dd:ee:ff 00:11:22:33:44:55 WINDOWS-LAPTOP-001 DESKTOP-GP01 GP-CLIENT
aa:bb:cc:dd:ee:ff
00:11:22:33:44:55
WINDOWS-LAPTOP-001
DESKTOP-GP01
GP-CLIENT
Palo Alto Networks is also encouraging customers to review GlobalProtect logs for successful gateway-connected events that correspond to the following hard-coded client configuration values from a proof-of-concept (PoC) exploit -
endpoint_os_version : Microsoft Windows 10 Pro 64-bit
source_user_info.domain : empty
Late last month, the U.S. Cybersecurity and Infrastructure Security Agency (CSIA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies address the flaw by June 1, 2026.