Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Palo Alto Networks Unit 42 has issued an urgent warning about active exploitation of CVE-2026-0257<\/a>, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software.<\/p>\n The flaw allows unauthenticated remote attackers to circumvent security controls and initiate unauthorized VPN connections without requiring any credentials.<\/p>\n The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV)<\/a> catalog on May 29, 2026, reflecting the severity and confirmed in-the-wild exploitation activity.<\/p>\n Unit 42 researchers identified<\/a> an unidentified threat actor actively probing GlobalProtect-enabled devices. While the attacker successfully probed a broad set of targets, only a small portion established actual VPN sessions, resulting in gateway-connected events. No post-access behavior, lateral movement, or data exfiltration has been confirmed at this time, but the window remains open.<\/p>\n Organizations are urged to immediately hunt for indicators of compromise (IOCs) in their GlobalProtect logs and activate incident response protocols for any successful gateway-connected events tied to the listed indicators.<\/p>\n Organizations should immediately review the official Palo Alto Networks security advisory<\/a>, apply available workarounds, or upgrade to a patched PAN-OS version. Rapid7 has also published a technical analysis<\/a> of observed exploitation activity in the wild.<\/p>\n Threat hunters should search GlobalProtect logs for successful login connections from the following IP addresses, particularly for activity predating the public PoC release on May 29, 2026:<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates.<\/strong><\/p>\n The post Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nIP Address Indicators<\/strong><\/h3>\n
\n\n
\n \nIP Address<\/th>\n Context<\/th>\n Phase<\/th>\n<\/tr>\n<\/thead>\n \n 23.128.228[.]6<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 104.207.144[.]154<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 146.19.216[.]119<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 146.19.216[.]120<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 146.19.216[.]125<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 179.43.172[.]213<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 185.195.232[.]139<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 198.12.106[.]60<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n \n 202.144.192[.]47<\/td>\n Malicious source IP<\/td>\n Pre-PoC (before May 29, 2026)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n Host-Based Indicators<\/strong><\/h3>\n
\n\n
\n \nIndicator<\/th>\n Type<\/th>\n Context<\/th>\n<\/tr>\n<\/thead>\n \n aa:bb:cc:dd:ee:ff<\/td>\n MAC Address<\/td>\n Suspicious device identifier in GlobalProtect logs<\/td>\n<\/tr>\n \n 00:11:22:33:44:55<\/td>\n MAC Address<\/td>\n Suspicious device identifier in GlobalProtect logs<\/td>\n<\/tr>\n \n WINDOWS-LAPTOP-001<\/td>\n Hostname<\/td>\n Suspicious host ID in GlobalProtect logs<\/td>\n<\/tr>\n \n DESKTOP-GP01<\/td>\n Hostname<\/td>\n Suspicious host ID in GlobalProtect logs<\/td>\n<\/tr>\n \n GP-CLIENT<\/td>\n Hostname<\/td>\n Suspicious host ID in GlobalProtect logs<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n Post-PoC Hard-Coded Client Configuration Indicators<\/strong><\/h3>\n
\n\n
\n \nField<\/th>\n Value<\/th>\n Context<\/th>\n<\/tr>\n<\/thead>\n \n endpoint_os_version<\/td>\n Microsoft Windows 10 Pro 64-bit<\/td>\n Hard-coded in PoC exploit code<\/td>\n<\/tr>\n \n source_user_info.domain<\/td>\n (empty)<\/td>\n Hard-coded in PoC exploit code<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n