Palo Alto Networks Warns of GlobalProtect Flaw, Citing Active VPN Exploitation

Palo Alto Networks disclosed a critical PAN-OS software vulnerability on June 15, 2026. The flaw, identified as CVE-2026-0257, enables authentication bypass within GlobalProtect VPN portal and gateway components.

Unknown threat actors are actively exploiting the vulnerability to establish unauthorized VPN connections. Initial malicious activity surfaced on May 17, 2026.

The company released indicators of compromise to assist with detection. Customers must review logs for specific patterns associated with the exploit.

The company has not observed any post-access lateral movement within compromised networks. The U.S. Cybersecurity and Infrastructure Security Agency previously mandated federal patches by early June.