CERT24Rapid7 confirms active exploitation of forged VPN cookies against multiple customersLoading data…
CERT24Threat Observatory
Period

Rapid7 confirms active exploitation of forged VPN cookies against multiple customers

Rapid7 confirmed active exploitation of CVE-2026-0257 across multiple customer environments. The vulnerability affects the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS and may allow attackers to bypass authentication and establish unauthorized VPN connections.

← Back to intelligence

Rapid7 confirms active exploitation of forged VPN cookies against multiple customers

Rapid7 confirmed active exploitation of CVE-2026-0257 across multiple customer environments. The vulnerability affects the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS and may allow attackers to bypass authentication and establish unauthorized VPN connections.