Palo Alto Networks has disclosed active exploitation of a recently patched PAN-OS vulnerability by an unknown threat actor targeting GlobalProtect portals. The flaw, tracked as CVE-2026-0257, enables unauthorized access to affected systems.

The vulnerability carries a CVSS score of 7.8, indicating high severity. The company has observed real-world attacks, though the number of compromised systems remains undisclosed. The flaw affects the portal and gateway components of PAN-OS, making it a critical vector for perimeter breaches.

The authentication bypass allows attackers to circumvent login credentials on GlobalProtect interfaces. Technical specifics of the exploit mechanism have not been publicly detailed, but Palo Alto Networks confirmed that unauthorized access has been achieved in observed incidents. Indicators of compromise likely include anomalous session logins or unexpected portal access logs.

Palo Alto Networks has released security updates to address CVE-2026-0257. Administrators are urged to apply patches immediately to GlobalProtect portals and gateways. No workarounds have been provided, and the vendor emphasizes patching as the sole mitigation. The timeline for full deployment varies by organization, but urgency is high given confirmed exploitation.

The threat actor behind the attacks remains unidentified. This incident underscores the persistent risk of VPN appliances as attack surfaces, echoing trends in recent perimeter-focused campaigns. Palo Alto Networks continues to monitor for further malicious activity.