Rapid7 Observes Active Exploitation of PAN‑OS GlobalProtect Auth Bypass (CVE‑2026‑0257)
Rapid7’s Managed Detection and Response team observed real‑world exploitation of Palo Alto Networks’ PAN‑OS GlobalProtect authentication bypass (CVE‑2026‑0257) across multiple customers as early as May 17, 2026. The vulnerability lets unauthenticated attackers establish VPN connections, prompting Rapid7 to urge urgent patching despite its medium CVSS rating.