Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

Rapid7 reports observed exploitation of PAN-OS GlobalProtect authentication bypass (CVE-2026-0257). Palo Alto Networks published an advisory on 2026-05-13: when a specific configuration is present, the vulnerability allows a remote, unauthenticated attacker to establish a VPN session through the GlobalProtect gateway (affecting PAN-OS and Prisma Access). Rapid7 MDR observed successful exploitation across multiple customers (earliest observed 2026-05-17) but did not see evidence of lateral movement from compromised devices. Although the CVSSv4 score is listed as medium, Rapid7 urges treating it