PAN-OS CVE-2026-0257: GlobalProtect VPN Bypass and CTEM Response

1. An attacker can reach the GlobalProtect service. Your first defensive question is whether that route exists from an untrusted network and whether the deployment falls within the vendor's affected scope.
2. The attacker takes advantage of the authentication bypass to establish an unauthorized VPN connection. This is the outcome described for the CVE, rather than a claim that the attacker has stolen a legitimate user's password.
3. The connection creates a potential foothold whose reach depends on your network controls. You should determine which destinations and services a VPN session could access, without assuming that all internal systems become reachable.
4. Your investigation then separates connection establishment from subsequent activity. Evidence of an unauthorized session warrants response, but claims about data access or changes require additional supporting records.

• Build a deployment list that includes the running PAN-OS version, GlobalProtect component roles, reachable addresses, service owner, and change owner. Compare configuration evidence with inventory records so forgotten or recently changed systems do not escape review.
• Where records permit, correlate accepted VPN sessions with identity and authentication events. Investigate sessions for which you cannot establish the expected authorization history. Missing correlation is a lead to examine, not proof of exploitation, because logging gaps can produce similar uncertainty.
• Look for unusual connection sources, unexpected session timing, and access patterns inconsistent with the associated user or device. Assess these signals together. An unfamiliar source address alone does not identify CVE-2026-0257 exploitation.
• Review traffic from questionable VPN sessions toward internal resources. Focus on whether the connection reached sensitive destinations and whether those services recorded successful access. This helps distinguish an unauthorized connection from a demonstrated downstream compromise.
• Preserve available connection, authentication, configuration, and traffic records before changes reduce their availability. The supplied facts contain no verified indicators or exact detection query. Check the vendor advisory for additional guidance, and document any blind spots that limit your conclusions.

Do this now

• Assign an accountable response owner and confirm affected deployments without waiting for a perfect enterprise inventory. Prioritize systems that combine an affected release, reachable GlobalProtect service, and access to important resources.
• Read the current vendor advisory and apply its instructions for your deployment. The supplied information does not identify a fixed version or a specific validated workaround, so neither should be guessed.
• Follow CISA's required action: implement vendor directed mitigations, observe applicable BOD 22-01 guidance for cloud services, or discontinue use when mitigations are unavailable. Coordinate any service interruption with the people who depend on remote access.
• If your review identifies suspicious VPN activity, open an incident investigation alongside remediation. Correcting the vulnerable condition does not establish what an earlier session accessed or resolve any separate compromise that investigation uncovers.

If you cannot patch yet

• If remediation cannot happen immediately, evaluate temporary restrictions on service reachability and VPN destination access. Treat these as potential exposure reductions requiring testing and approval, not as confirmed fixes for this vulnerability.
• Do not assume that enabling multifactor authentication, changing passwords, or adding monitoring removes this bypass. The supplied facts do not establish those measures as mitigations. Confirm any proposed workaround against the vendor's specific guidance.

Longer term hardening

• Maintain an inventory that links GlobalProtect deployments to software versions, access policies, business owners, and change windows. Make it possible to answer both where the vulnerable component exists and what access it could provide.
• After remediation, verify the running software and relevant configuration on every in scope instance. Confirm that intended access still works and that temporary restrictions have either been retained deliberately or removed through an approved change.
• Improve session correlation and evidence retention where the investigation found gaps. Your goal is to determine not only whether a connection occurred, but also whether it was authorized and what it subsequently reached.

• CWE-565 More CVEs with this weakness

• ▸NVD entry
• ▸CVE.org record
• ▸CISA Known Exploited Vulnerabilities catalog
• ▸Palo Alto Networks security advisory
• ▸Advisory on cert-portal.siemens.com
• ▸CISA advisory