Palo Alto Networks has confirmed that hackers are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in GlobalProtect VPN, to breach corporate networks.
The vulnerability allows attackers to circumvent authentication mechanisms in Palo Alto's GlobalProtect VPN gateway, potentially granting unauthorized access to internal enterprise systems without valid credentials.
What's affected
The flaw impacts Palo Alto Networks PAN-OS, the operating system powering the company's next-generation firewalls and VPN gateways. GlobalProtect is widely deployed across enterprises for secure remote access.
Active exploitation
The company confirmed the vulnerability is being weaponized in real-world attacks. Details on the attack vectors and scope of compromises remain limited, though Palo Alto has advised customers to prioritize patching efforts.
Severity
Authentication bypass flaws in VPN infrastructure are considered critical vulnerabilities because they provide direct pathways to corporate networks. Successful exploitation enables attackers to establish persistent access and move laterally to steal data or deploy ransomware.
Remediation
Palo Alto Networks has released patches for affected PAN-OS versions. The company recommends immediate updates and network monitoring for signs of exploitation, including unusual VPN connection patterns or authentication failures followed by successful logins.
Context
This incident follows a pattern of high-profile VPN vulnerabilities exploited by threat actors. Palo Alto's security products are among the most widely deployed firewalls globally, making any critical flaw a concern across numerous organizations.
Chinese startup Z.AI has open sourced its ZCode coding assistant and disabled certain features following user complaints that the tool was uploading codebases to overseas servers without permission.
The Open Observatory of Network Interference (OONI) is expanding its crowdsourced effort to map global internet censorship. The project invites users to contribute measurements to what it describes as the largest open dataset on network interference.
A new technique allows attackers to exfiltrate neural network weights from machine learning models, potentially exposing proprietary AI systems. Security researchers demonstrated the vulnerability across multiple model architectures.
A malicious npm campaign demonstrates how threat actors are evading supply chain protections by embedding malware in package runtime behavior instead of installation scripts. The 'indexed-btree' package exemplifies this evolving attack technique.