Attackers are slipping into corporate networks through Palo Alto Networks firewalls without ever entering a valid password. Palo Alto Networks Unit 42 is tracking active exploitation of CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway, the VPN that staff use to reach internal systems from outside the office. In a June 5, 2026 threat brief, Unit 42's Andy Piazza reports that an unidentified hacker is using the flaw to skip past login checks and open unauthorized VPN sessions on internet-facing firewalls. This is a separate issue from CVE-2026-0300, the unauthenticated root remote-code-execution bug in the PAN-OS User-ID Authentication (Captive) Portal that IntelFusions covered earlier.
What's affected
The flaw lives in GlobalProtect, Palo Alto Networks' SSL and IPsec VPN. An authentication bypass means a remote attacker who has no account can trick the system into treating them as a logged-in user. Here that translates to a working VPN session, effectively a foot in the door on the internal network. Unlike CVE-2026-0300, this bug does not give attackers the ability to run code or grab admin rights on its own. The danger is the unauthorized access itself, which can become a launchpad for further attacks. Palo Alto Networks has published a security advisory that lists the affected PAN-OS versions and the fixed releases, so check it for exact version details.
How the attack works
Exploitation attempts started before May 29, 2026, ahead of any public proof-of-concept (PoC) code, the demonstration scripts that show how to trigger a bug. Once PoC code began circulating, a wider wave of opportunistic scanning followed. So far only a small number of probed devices actually opened a VPN session, and Unit 42 has not seen any follow-on activity such as lateral movement (attackers spreading from the first machine to others). Unit 42 assesses with moderate confidence that this looks like early, mostly automated probing rather than a focused break-in campaign, and that attempts will climb now that working exploit code is available.
Unit 42 shared the IP addresses caught probing GlobalProtect, plus values hard-coded into the public PoC that make for high-confidence alerts. These indicators are defanged below; only re-arm them in controlled environments. Scanning source IPs include 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, and 202.144.192[.]47. The PoC also leaves telltale fingerprints in logs: MAC addresses aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55; machine names WINDOWS-LAPTOP-001, DESKTOP-GP01, and GP-CLIENT; and a client OS string of Microsoft Windows 10 Pro 64-bit paired with an empty source-user domain.
What you should do
Install the fixed PAN-OS release named in the Palo Alto Networks advisory as a priority for any firewall whose GlobalProtect portal or gateway is reachable from the internet. Until you can patch, limit GlobalProtect exposure where possible, require multi-factor authentication for VPN logins, and comb through GlobalProtect authentication and session logs for connections matching the PoC fingerprints above or coming from the listed IPs. Because a successful attack hands over a VPN session rather than direct code execution, also watch for odd behavior after a connection, such as unexpected internal scanning, new accounts, or attempts to steal credentials from recently created GlobalProtect sessions.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.