CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on 29 May 2026. CISA describes an authentication bypass in PAN-OS that can establish an unauthorized VPN connection.
Key takeaways
- CISA catalog inclusion establishes that the CVE is tracked as exploited; it does not establish exposure in any particular environment.
- Prioritize internet-facing PAN-OS VPN gateways, vendor remediation, and review of remote-access authentication records.
This is a historical assessment of the May 2026 advisory window. The relevant fact is CISA's catalog inclusion and its description of unauthorized VPN connection risk.
The practical response begins with inventory: identify PAN-OS remote-access services, confirm version and vendor guidance, then inspect authentication and VPN session records for the period before remediation.
What the sources establish
CISA lists CVE-2026-0257 as a PAN-OS authentication bypass and records known ransomware campaign use as known. Palo Alto Networks publishes the product advisory; NVD provides a CVE record for cross-checking metadata.
Defensive checks
Confirm whether affected PAN-OS VPN functionality was exposed. Apply the vendor's remediation, preserve relevant VPN and administrator logs, and investigate unexpected accounts, sessions or configuration changes. A patch removes a condition; it does not prove that earlier access did not occur.
Sources
Treat this as a dated, source-linked record. Current version scope and mitigation details belong to the vendor advisory.
Editorial feedback
Have a correction or additional primary evidence? Contact the editorial team and include this article’s URL.