Authentication bypass in Palo Alto PAN-OS (CVE-2026-0257) — allows unauthorized VPN connections

1A flaw in the next-generation firewall

CVE-2026-0257 is an authentication-bypass vulnerability in PAN-OS, the operating system that runs on Palo Alto Networks next-generation firewall products. It was added to CISA's KEV catalog on May 29, 2026 and is classified as CWE-565 (reliance on cookies without validation and integrity checking).

2Unauthorized VPN sessions being established

When exploited, an attacker bypasses the intended security restrictions and establishes an unauthorized VPN connection. Firewalls / VPN gateways sit at the boundary between the internal network and the outside; breaking through one hands the attacker a foothold for internal intrusion.

Vulnerabilities in perimeter-defense products have repeatedly been exploited as the initial access vector in ransomware and state-linked attacks, so priority is high.

3Edge devices are regulars on KEV

Equipment placed at the boundary between an organisation and the outside — firewalls and VPN gateways — appears on KEV repeatedly. Counted by vendor, the concentration is plain.

Of the 1,687 records held as of 2026-09-01, vendors of edge and remote-access equipment — the above plus Zyxel at 12, F5 at 7 and Check Point at 3 — account for 238, or 14 percent. Vulnerabilities in perimeter products have been used repeatedly as the initial access route in ransomware and state-linked attacks in recent years, which puts them high in priority.