Is CVE-2026-0257 (Palo Alto Networks PAN-OS Authentication Bypass) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 18, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalogue on 29 May 2026, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

What the KEV Listing Means for Exposure Verification

This is not just a vendor advisory note, it is a prioritisation signal that the issue has moved from theoretical to actionable. For a PAN-OS environment, the immediate question is whether any internet-facing VPN or management path could accept an unauthorised connection through the bypass condition, especially where exposure is layered behind remote access workflows or edge-device rules.

Because CISA added the CVE to KEV, teams should treat the affected appliance class as a high-priority exposure check and CISA Known Exploited Vulnerabilities Catalog as the authoritative trigger for response timing. The broader pattern is the same as other exploited edge-device issues tracked in the Edge Device Security Guide: if the device is remotely reachable and handling trust decisions, you need to verify whether that trust boundary is still intact.

For incident teams, the useful distinction is between “patched eventually” and “exposed now.” If the appliance was reachable during the vulnerable period, assume the bypass could have been used to create a foothold even if you have not yet seen a clean login event.

Why an Authentication Bypass on PAN-OS Matters Operationally

An authentication bypass on a perimeter platform is serious because it can convert a trust boundary into an entry point. In practice, that means a user or device may be able to establish access without the normal identity check, which can undermine VPN gating, admin separation, and any downstream logging that assumes the session was legitimate.

That risk is amplified on devices that sit at the edge of the network. A bypass on a firewall or VPN platform can expose internal services, enable lateral movement, and make detection harder because the traffic may look like a permitted remote session rather than obvious exploitation. The same failure mode appears in other appliance compromises where stolen or bypassed credentials let attackers operate inside normal access paths, as seen in the CitrixBleed 2 2025 pattern of VPN session abuse.

If CISA also lists the CVE as used in ransomware campaigns, the consequence is not limited to unauthorised login. It raises the probability that the bypass is part of a broader intrusion chain that can end in encryption, extortion, or credential harvesting from the same trust zone.

What to Check Before You Assume You Are Safe

Start with exposure, then move to evidence. Confirm whether any PAN-OS instance was internet-facing, whether VPN services were enabled, and whether management interfaces or remote-access functions were reachable from untrusted networks during the vulnerable window. Then check logs for unusual authentication patterns, unfamiliar VPN establishment attempts, and access from geographies, sources, or devices that do not match normal administrator or user behaviour.

Where the bypass may have provided access to session material, API credentials, or other secrets stored near the appliance workflow, widen the review to adjacent identities and credentials. In practice, compromise of a perimeter session often creates more risk than the initial login path, which is why teams handling exploited edge systems should look for credential reuse and stale trust relationships as part of the same review.

Do not stop at “no alerts found.” Many exploited appliance cases are visible first through configuration changes, odd outbound connections, or new remote-access sessions that do not line up with normal business use. If the device supports detailed logging, preserve it before remediation so you can compare pre- and post-fix activity.

Risk and Threat Considerations

This kind of flaw is valuable to attackers because it removes the need to steal valid credentials first. A successful bypass on a perimeter VPN or firewall can turn a protective control into a covert access path, and that access may be attractive for ransomware operators, credential theft, or follow-on movement deeper into the environment.

Failure mechanism: The vulnerable product accepts an unauthorised connection or session as if it were authenticated, so the attacker can cross the trust boundary without passing the intended access check.

Impact: The organisation may face unauthorised remote access, hidden persistence, lateral movement, and a materially higher chance of ransomware deployment or further compromise before the intrusion is detected.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation of a KEV-listed CVE requires prioritised vulnerability handling.
Recommendation — Prioritise remediation of the exposed PAN-OS systems and verify closure with retesting.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A known exploited appliance flaw requires timely remediation and verification.
	IA-2 — Identification and Authentication (Organizational Users)	The issue is an authentication bypass that undermines access checks for legitimate users.
Recommendation — Apply flaw remediation to the affected PAN-OS systems and confirm the fix took effect. Review authentication paths and ensure the bypass cannot establish access without valid identity proof.
OWASP ASVS	V6 — Authentication	The core issue is a failure in authentication enforcement on the affected access path.
Recommendation — Re-test authentication enforcement on the VPN or login flow after remediation.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The CVE affects an exposed perimeter service that can be abused from the network.
Recommendation — Map any observed access to public-facing exploitation and hunt for follow-on activity.

Practitioner Guidance

What to prioritise: Treat exploitability and exposure as the first decision point. If the device was internet-facing, prioritise patching or mitigation before spending time proving compromise, because an actively exploited edge bypass can be sufficient for re-entry even after initial containment.

What to verify: Validate whether any VPN, admin, or remote access session was established outside expected patterns, and preserve logs, configs, and authentication records before making changes. If the platform cannot provide enough history, assume your confidence is lower and widen the post-remediation hunt.

Practitioner takeaway: For an actively exploited perimeter authentication bypass, the safe assumption is not “we would have noticed,” but “we need to prove the boundary held and that no session or adjacent secret was exposed.”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org