Attackers are exploiting Palo Alto Networks defect that initially flew under the radar

A critical authentication-bypass vulnerability, CVE-2026-0257, is being actively exploited in Palo Alto Networks firewalls, prompting urgent responses from researchers and threat hunters. Initially assessed as medium-severity on May 13, the company quickly reassessed the defect as critical after Rapid7 confirmed its exploitation in the wild¹. The Cybersecurity and Infrastructure Security Agency has also added the vulnerability to its known exploited vulnerabilities catalog, underscoring the escalated threat it poses. The vulnerability's active exploitation status has significant implications for Palo Alto Networks customers, who must now determine whether to patch immediately or continue monitoring the situation. As the exploitation status of CVE-2026-0257 continues to evolve, it is crucial for practitioners to stay vigilant and prioritize patching to prevent potential attacks, so what matters most is the timely application of security patches to prevent attackers from leveraging this critical vulnerability.