Palo Alto Networks PAN-OS Authentication Bypass Exploited in the Wild

#cybersecurity #infosec

Summary

Palo Alto Networks patched a high-severity authentication bypass vulnerability (CVE-2026-0257) in PAN-OS and Prisma Access that is being exploited to gain unauthorized VPN access. The flaw allows attackers to forge session cookies when encryption certificates are shared with HTTPS services.

Take Action:

If you use Palo Alto Networks PAN-OS or Prisma Access with GlobalProtect, ASAP, your devices are already under attack. Review the advisory and upgrade to the respective patched version (12.1.7, 11.2.12, 11.1.15, or 10.2.18-h6). If you can't patch right away, disable the authentication override feature or generate a separate certificate just for cookie encryption that isn't shared with the HTTPS service.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines