Exploited vulnerability · CISA KEV
Yes. CVE-2026-0257, Palo Alto Networks PAN-OS Authentication Bypass Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 29 May 2026, 16 days after it was published. It is known to be used in ransomware campaigns. It affects Palo Alto Networks PAN-OS, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
| Vendor | Palo Alto Networks (16 exploited CVEs in KEV) |
| Product | PAN-OS |
| Vulnerability | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
| Weakness | CWE-565 |
| Published | 13 May 2026 |
| Added to KEV | 29 May 2026 |
| Reported by (CNA) | palo_alto |
Yes. CISA added CVE-2026-0257 to the Known Exploited Vulnerabilities catalog on 29 May 2026, which means there is reliable evidence of exploitation in the wild.
Yes, CISA lists it as known to be used in ransomware campaigns.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Check Palo Alto Networks's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected PAN-OS and watch it for signs of compromise.
Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in May 2026 · Palo Alto Networks scorecard · act-now radar.
We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.
Get in touch →