FortiGuard Outbreak Alert: Palo Alto Networks PAN-OS GlobalProtect Auth Bypass
Description | Palo Alto Networks PAN-OS GlobalProtect is a secure remote-access VPN solution integrated with PAN-OS firewalls that provides users with authenticated, encrypted access to corporate networks and applications from anywhere. Attackers are actively exploiting PAN-OS GlobalProtect authentication bypass vulnerability to gain unauthorized VPN access to exposed Palo Alto Networks firewalls. CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect which allows unauthenticated attackers to bypass security restrictions and establish unauthorized VPN connections. For affected and fixed product versions, refer to the Palo-Alto security advisory links below: CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities | ||||||||
CVE ID | |||||||||
NDR Cloud Detection Rule | FortiNDR Cloud v26.2b+
| ||||||||
Playbook | N/A | ||||||||
Threat Hunting | FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for 'Palo Alto Networks PAN-OS GlobalProtect Auth Bypass' related activities.
| ||||||||
Suricata/DPI Coverage | Customers can create custom investigation/detections using the DPI and Suricata signatures below: DPI:
Suricata:
| ||||||||
Other Fortinet Products | For more details regarding mitigating the vulnerability by utilizing Fortinet products, refer to Palo Alto Networks PAN-OS GlobalProtect Auth Bypass. |
