DaystoPatch

Palo Alto NetworksExploited incident

PAN-OS GlobalProtect authentication override cookie bypass

CVE-2026-0257High, CVSS 7.8In CISA's Known Exploited Vulnerabilities catalog since 29 May 2026

  • Exploited after a fix existed
  • Known ransomware use
FixedFixed for every supported version 15 days after the first public report.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fixUnverified source
Follow-through
15d
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0257 (advisory page)CuratedQuote not checked yet

    2026-05-13 Initial publication.

    Discovered internally; the advisory is the first public signal. At publication it said 'Palo Alto Networks is not aware of any malicious exploitation of these issues.' (Wayback 20260513224134). Time from this timeline entry's data-date attribute (2026-05-13T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2026-0257ClaimedQuote verified13 May 2026, 18:15 UTC

    Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b16dd7bbe366a474…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 May 2026, 19:03 UTC

    Paloaltoの脆弱性情報 「CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (Severity: MEDIUM)」が公開されました。

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-0257)ClaimedQuote verified29 May 2026

    Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2026-05-29.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet30 May 2026, 08:20 UTC

    Palo Alto Networks Warns of Active Exploitation of GlobalProtect Flaw Palo Alto Networks has issued a warning about a critical GlobalProtect flaw, CVE-2026-0257, that is being actively exploited,

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    News: thehackernewsClaimedQuote verified20 Oct 2026, 15:32 UTC

    Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

    Earliest mention we hold (a vetted outlet).

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c1479d64a1cf1a66…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0257 (advisory page)CuratedQuote not checked yet

    2026-05-13 Initial publication.

    Time from this timeline entry's data-date attribute (2026-05-13T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks advisory CVE-2026-0257 (Wayback snapshot 2026-05-13 22:41 UTC)CuratedQuote verified

    Customers can mitigate the risk of this issue by taking any of the following actions:

    Mitigations (dedicated certificate for authentication override cookies, or disable Authentication Override) were in the initial advisory; time from the advisory timeline's initial publication (data-date).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:62afb78ee33ee5ad…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Palo Alto Networks advisory CVE-2026-0257 (Wayback snapshot 2026-05-13 22:41 UTC)CuratedQuote verified

    Upgrade to 11.1.4-h33 or 11.1.15 or later.

    At initial publication 11.1.4-h33, 11.1.6-h32, 11.1.10-h25, 11.1.13-h5, 10.2.10-h36 and 10.2.18-h6 carried no ETA (available); every 12.1 and 11.2 fix and several 10.2/11.1 fixes were marked '(ETA: ...)'. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:62afb78ee33ee5ad…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified14 May 2026, 19:15 UTC

    Updated the Fix release timeline for 10.2.16-h7.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified15 May 2026, 04:00 UTC

    Updated the Fix release timeline for 11.2.7-h14 and 11.2.10-h7.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified15 May 2026, 23:00 UTC

    Updated the Fix release timeline for 12.1.4-h6.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified16 May 2026, 01:15 UTC

    Updated the Fix release timeline for 10.2.13-h21.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified20 May 2026, 23:30 UTC

    Updated the Fix release timeline for 10.2.7-h34.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified28 May 2026, 00:00 UTC

    Updated the Fix release timeline for 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Palo Alto Networks advisory CVE-2026-0257ClaimedQuote verified28 May 2026, 21:00 UTC

    Updated the Fix release timeline for 12.1.7.

    CaveatRevision adds or updates fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +15d

    Palo Alto Networks advisory CVE-2026-0257 (advisory page timeline)CuratedQuote verified

    2026-05-28 Updated the Fix release timeline for 12.1.7.

    Last fix to ship; 12.1.5-12.1.6 users had no fix before 12.1.7. Staggered releases per the timeline: 10.2.16-h7 2026-05-14T19:15Z; 11.2.7-h14 and 11.2.10-h7 2026-05-15T04:00Z; 12.1.4-h6 2026-05-15T23:00Z; 10.2.13-h21 2026-05-16T01:15Z; 10.2.7-h34 2026-05-20T23:30Z; 11.1.15, 11.1.7-h6, 11.2.4-h17 and 11.2.12 2026-05-28T00:00Z; 12.1.7 2026-05-28T21:00Z. The Wayback snapshot of 2026-05-31 shows no remaining ETAs. Time from this timeline entry's data-date attribute (2026-05-28T21:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d365e98f4deda459…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. CVE-2026-0257

    Recorded in the revision history

    PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

    CVSS exploit maturity changed from unreported to attacked (displayed score 4.7 to 7.8). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 4 rows added and 4 rows removed. One new row reads "PAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7".

    • Severity
    • Exploitation status
    • Fixed versions
    CVSS exploit maturity
    Beforeunreported
    Afterattacked
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Version table rows
    BeforePAN-OS 12.1 | = 12.1.4-h6 (ETA: 05/18) >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h14 (ETA: 05/14) >= 11.2.10-h7 (ETA: 05/14) >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28
    AfterPAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7; PAN-OS 11.2 | = 11.2.4-h17 >= 11.2.7-h14 >= 11.2.10-h7 >= 11.2.12; PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15; PAN-OS 10.2 | = 10.2.7-h34 >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6
    Earlier version captured 14 May 2026, 07:06 UTC: archived copyLater version captured 31 May 2026, 07:00 UTC: archived copyRecovered from archived copiesSnapshots b630683187… and 2d5ed451df…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • PAN-OS (GlobalProtect portal and gateway)
  • Prisma Access
How we built this timeline

Interpretation: each 'Updated the Fix release timeline for X' timeline entry is read as X being released; this matches the Wayback snapshots (11.2.7-h14 still had '(ETA: 05/14)' at 14 May 2026 07:06Z and its timeline entry is 15 May 2026). Exploitation: 'Updated exploitation status' at 29 May 2026, now reading 'Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.', after every fix had shipped, so exploited before a fix is false.

KEV (29 May 2026) marks ransomware use Known. Severity: CVSS-B 7.8 (the initial advisory rated it MEDIUM with CVSS-BT 4.7; raised to HIGH/7.8 after exploitation).

Exposure requires GlobalProtect with authentication override cookies enabled.

Related

Palo Alto Networks report card