CVE-2026-0257

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS (affected versions not specified) Palo Alto Networks Prisma Access (affected versions not specified) Siemens RuggedCom APE1808 Firmware (affected versions not specified)

Description Authentication bypass flaws in the GlobalProtect portal and gateway allow a remote attacker to circumvent security restrictions and establish unauthorized VPN connections. The issue stems from the use of cookies without proper authenticity and integrity verification. Real-world exploitation has been observed by ransomware groups, including Qilin and Inc, targeting the financial, healthcare, and manufacturing sectors. These attacks have involved bypassing multi-factor authentication (MFA) for VPN sessions, pivoting to the virtualization layer to compromise VMware ESXi and vCenter, and dumping domain controller credentials from virtual disks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.