Arctic Wolf Observes an Increase in Palo Alto Networks GlobalProtect Authentication Bypass Exploitation via CVE-2026-0257 (opens in new tab)  🖥️VPS

Key Takeaways Arctic Wolf observed a wave of CVE-2026-0257 exploitation activity in late May and early June 2026, following the publication of working exploit code and technical details about the vulnerability. The campaign is still ongoing as of this publication. Successful exploitation requires specific configuration conditions, including GlobalProtect portal or gateway exposure, authentication override cookies, ... Arctic Wolf Observes an Increase in Palo Alto Networks GlobalProtect Authen...