All vulnerabilities
CVE-2026-0257

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Palo Alto Networks PAN-OSNetwork & edge
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 29 May 2026. Known ransomware useCISA KEV
Exploit odds (EPSS)96.9%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.1.7, 12.1.4-h6Also 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17, 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33 and 3 moreCVE List
Federal deadline1 Jun 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 12.1.7, 12.1.4-h6PAN-OSCVE List
  • 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17PAN-OSCVE List
  • 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33PAN-OSCVE List
  • 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34PAN-OSCVE List
  • 10.2.10-h36Prisma AccessCVE List
  • 11.2.7-h13Prisma AccessCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 13 May 2026, 18:15 UTCPublishedCVE List
  2. 29 May 2026Added to CISA KEVCISA KEV
  3. 20 Oct 2026, 15:32 UTCFirst reported exploitedThe Hacker News

Public exploit code and templates 1

  • Scanner templatePalo Alto Networks PAN-OS - Authentication BypassNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 2

One outlet report exploitation. Reports are not confirmation; each links to its source.

Description

Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

Text from CVE List

Affected versions 7

  • Cloud NGFWunaffected: AllCVE List
  • PAN-OSaffected: 12.1.0 before 12.1.7, 12.1.4-h6CVE List
  • PAN-OSaffected: 11.2.0 before 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17CVE List
  • PAN-OSaffected: 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33CVE List
  • PAN-OSaffected: 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34CVE List
  • Prisma Accessaffected: 10.2.0 before 10.2.10-h36CVE List
  • Prisma Accessaffected: 11.2.0 before 11.2.7-h13CVE List

References 4