CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS
2026-05-15T07:23:52Z•3b47c8c879d31d1a8f282bba2ef5be7939360f7488a7508bd4ca6f70387bb180
Cisco Catalyst SD-WANCloud Authentication ServiceDTLSMicrosoft Teams phishingModeloRATPA-SeriesPAN-OSPalo Alto NetworksPanoramaPatch TuesdayVM-SeriesWindows Netlogonauthentication-bypasscredential-theftcriticalcvss-10.0exploited-in-the-wildlateral-movementremote-authentication-bypassremote-code-executionvdaemon
What happened
Rapid7 posts highlight multiple high-impact vulnerabilities and active intrusion techniques. Key disclosures: CVE-2026-20182 is a critical (CVSS 10.0) authentication-bypass in Cisco Catalyst SD‑WAN Controller’s vdaemon (DTLS/UDP 12346) that can allow a remote unauthenticated attacker to become an authenticated peer and perform privileged operations (fixed). CVE-2026-0265 is a signature‑verification/authentication bypass in Palo Alto PAN‑OS when Cloud Authentication Service (CAS) is enabled (non-default but common) — Palo Alto rates it High (7.2). Microsoft’s May 2026 Patch Tuesday includes CVE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 3b47c8c879d31d1a8f282bba2ef5be7939360f7488a7508bd4ca6f70387bb180
- Enrichment time
- 2026-05-15T07:23:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.