Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

A critical authentication bypass vulnerability in Palo Alto Networks' GlobalProtect VPN, identified as CVE-2026-0257, is being actively exploited by hackers to breach corporate networks. This flaw allows attackers to bypass normal authentication procedures, potentially granting them unauthorized access to sensitive resources. Palo Alto Networks has warned that the vulnerability is being used in ongoing attacks, emphasizing the need for immediate attention. The exploitation of CVE-2026-0257 is a significant concern, as it could enable malicious actors to move laterally within a compromised network, exfiltrate data, or disrupt operations. As the situation continues to unfold, with discussions involving Palo Alto indicating the exploitation status will determine the necessary response¹. This matters to security practitioners because the exploitation of this vulnerability can have severe consequences, including data breaches and disruption of business operations, making it essential to apply patches or take mitigation measures promptly.