CVE-2026-0257 — PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Exploitation evidence

Known exploited · CISA KEV listed

Added 2026-05-29. Ransomware campaign use: Known.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date: 2026-06-01. This is the catalog’s deadline, not an assessment of your organization’s exposure.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

Palo Alto Networks / Cloud NGFW

Default status: unaffected

unaffected: All (custom)

Palo Alto Networks / PAN-OS

Default status: unaffected

affected: 12.1.0 to < 12.1.7, 12.1.4-h6 (custom)
- At 12.1.7: unaffected
- At 12.1.4-h6: unaffected
affected: 11.2.0 to < 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17 (custom)
- At 11.2.12: unaffected
- At 11.2.10-h7: unaffected
- At 11.2.7-h14: unaffected
- At 11.2.4-h17: unaffected
affected: 11.1.0 to < 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33 (custom)
- At 11.1.15: unaffected
- At 11.1.13-h5: unaffected
- At 11.1.10-h25: unaffected
- At 11.1.7-h6: unaffected
- At 11.1.6-h32: unaffected
- At 11.1.4-h33: unaffected
affected: 10.2.0 to < 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 (custom)
- At 10.2.18-h6: unaffected
- At 10.2.16-h7: unaffected
- At 10.2.13-h21: unaffected
- At 10.2.10-h36: unaffected
- At 10.2.7-h34: unaffected

Palo Alto Networks / Prisma Access

Default status: unaffected

affected: 10.2.0 to < 10.2.10-h36 (custom)
- At 10.2.10-h36: unaffected
affected: 11.2.0 to < 11.2.7-h13 (custom)
- At 11.2.7-h13: unaffected

Fixes and workarounds

Version Minor Version Suggested Solution Cloud NGFW All No action needed. PAN-OS 12.1 12.1.5 through 12.1.6 Upgrade to 12.1.7 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h6 or 12.1.7 or later. PAN-OS 11.2 11.2.11 or later Upgrade to 11.2.12 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h7 or 11.2.12 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h14 or 11.2.12 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h17 or 11.2.12 or later. PAN-OS 11.1 11.1.14 or later Upgrade to 11.1.15 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h5 or 11.1.15 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h25 or 11.1.15 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h6 or 11.1.15 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h32 or 11.1.15 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h33 or 11.1.15 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18 or 10.2.18-h6 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h7 or 10.2.18 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h21 or 10.2.18 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h36 or 10.2.18 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h34 or 10.2.18 or later. All older unsupported PAN-OS versions Upgrade to a supported fixed version. Prisma Access 10.2 10.2.0 through 10.2.10-h* Upgrade to 10.2.10-h36 or later. Prisma Access 11.2 11.2.0 through 11.2.7-h* Upgrade to 11.2.7-h13 or later.

Reported workarounds: Customers can mitigate the risk of this issue by taking any of the following actions: * Use a dedicated certificate for Authentication Override cookies: Generate a new certificate exclusively for authentication override cookies and store it securely. Do not reuse the portal or gateway certificate, and do not share this certificate with other features or users. * Disable Authentication Override: Uncheck the Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

Monitored source mentions

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.