Organizations running Palo Alto Networks PAN-OS should treat the latest advisory as urgent. The Dutch NCSC reports that a PAN-OS vulnerability is being actively exploited in the GlobalProtect portal and gateway components. Because the issue is rated very severe (CVSS 9.1/10), prompt action is essential to reduce the risk of unauthorized access.
In this article, you’ll find a clear overview of what’s happening, how the exploitation works at a high level, what the potential impact can be, and what steps you should prioritize right now.
What the PAN-OS vulnerability is and why it matters
The vulnerability in question is CVE-2026-0257. NCSC highlights that the weakness may allow attackers to gain unauthorized access to internal systems by leveraging VPN-related functionality. The GlobalProtect portal and gateway components are central here, because they support VPN connections into an organization’s network.
The severity is high because a successful compromise can move an attacker from the VPN entry point into systems that should remain protected. In short: if exploitation is successful and not addressed, the attacker’s next steps can extend well beyond the initial access.
How attackers can exploit it
According to the advisory, exploitation is possible for an attacker who is not authenticated, but only if certain settings are enabled. Two conditions are specifically mentioned:
- (HTTPS-)certificates are reused, and
- One of the following options is enabled: “Generate cookie for authentication override” or “Accept cookie for authentication override.”
This combination effectively creates a pathway for VPN-related authentication to be bypassed under particular configuration choices. NCSC also notes that a public Proof-of-Concept (PoC) is available describing the method, which can lower the barrier for misuse.
Importantly, NCSC references that security firm Rapid7 indicated active abuse since 17 May. That timing suggests exploitation is not theoretical; it is already occurring in the wild. In the coming period, NCSC expects the scale of misuse to increase.
Why “edge devices” draw attackers
The advisory points out that criminals often target edge devices—systems positioned at the boundary between public access and internal networks. GlobalProtect portal and gateway components fit this pattern because they commonly serve as the VPN entry point.
When an edge-facing service is vulnerable, attackers can potentially obtain a foothold where defenses may be less granular than inside the corporate network. That’s why the PAN-OS vulnerability response should be treated as a perimeter priority, not just a routine patch cycle.
Potential consequences if you do nothing
If the PAN-OS vulnerability is not addressed, an attacker may use the VPN path to reach internal systems. NCSC describes consequences that can include:
- Data breaches resulting from unauthorized access
- Disruption of business processes due to operational impact
- Further attacks within the network, after the attacker gains a foothold
The key takeaway is that VPN compromise often accelerates the intrusion lifecycle. Once inside, attackers may look for additional systems, credentials, and lateral movement opportunities.
Which versions are affected (and what is not)
Not every related product or deployment is necessarily vulnerable. NCSC advises readers to consult the version table published by Palo Alto Networks to confirm which PAN-OS versions are affected.
At the same time, NCSC states that Cloud NGFW and Panorama are not vulnerable for this issue. Still, the safe approach is to validate your specific environment and configuration choices against the vendor’s guidance.
Immediate actions: install updates as quickly as possible
Palo Alto Networks has released security updates to remediate this issue. NCSC’s recommendation is straightforward: install the updates as soon as possible, ideally through your standard change and patch management process.
If you’re unsure whether you run PAN-OS, or which version is deployed, contact your IT service provider. Even if you know you use GlobalProtect, you still need to confirm the exact software versions and whether the relevant configuration options could be present.
Validate exposure in the GlobalProtect portal and gateway
Because exploitation depends on specific settings, you should not only patch—also verify whether the conditions mentioned in the advisory exist in your environment. Focus on the two configuration aspects tied to the bypass behavior, and ensure your team understands how certificates and authentication override options are handled in your deployment.
Detecting abuse: use shared indicators of compromise
Rapid7 shared Indicators of Compromise (IoCs) to help detect exploitation. NCSC encourages organizations to use these IoCs where appropriate and to involve your IT service provider if you need help interpreting findings, tuning detections, or validating whether your systems have been impacted.
Even if you plan to patch immediately, detection efforts can provide additional assurance. If indicators suggest compromise, you may need to trigger incident response steps beyond updating.
Practical checklist for the next 24–48 hours
To turn the advisory into action, consider the following priorities:
- Confirm your software exposure: Identify the PAN-OS versions in use and compare them with the vendor’s vulnerability guidance.
- Apply security updates: Install the remediation updates without delay, following your organization’s risk-based change management.
- Review relevant configuration options: Check whether certificate reuse and the authentication override cookie settings are enabled.
- Run detection with IoCs: Use Rapid7’s IoCs and validate results with monitoring tools.
- Document outcomes: Record versions, update timelines, and detection results for auditability.
Following a structured approach helps you reduce uncertainty and ensures the response is repeatable across systems and teams.
Conclusion
The PAN-OS vulnerability tied to CVE-2026-0257 is not a distant risk—it is reported as being actively exploited against GlobalProtect portal and gateway components. With a CVSS score of 9.1/10 and a clear path to unauthorized VPN access under specific configurations, the most important step is to install the provided security updates as quickly as possible.
Patch promptly, verify whether your setup matches the conditions that enable exploitation, and use shared IoCs to improve detection. If you’re unsure about versions or configuration details, reach out to your IT service provider—now is the moment to remove ambiguity and strengthen access security.
Source: https://www.ncsc.nl/alerts/actief-misbruik-kwetsbaarheid-in-palo-alto-networks-pan-os
