{"id":231755,"date":"2026-06-15T04:04:00","date_gmt":"2026-06-15T08:04:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/15\/palo-alto-warns-of-globalprotect-vpn-vulnerability-actively-exploited-in-the-wild\/"},"modified":"2026-06-15T08:05:42","modified_gmt":"2026-06-15T12:05:42","slug":"palo-alto-warns-of-globalprotect-vpn-vulnerability-actively-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/15\/palo-alto-warns-of-globalprotect-vpn-vulnerability-actively-exploited-in-the-wild\/","title":{"rendered":"Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild"},"content":{"rendered":"

Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild<\/a><\/p>\n

https:\/\/cybersecuritynews.com\/palo-alto-vpn-vulnerability-exploited\/<\/a><\/p>\n

Publish Date: 2026-06-15 04:04:00<\/a><\/p>\n

Source Domain: cybersecuritynews.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

Palo Alto Networks Unit 42 has issued an urgent warning about active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software.<\/p>\n

The flaw allows unauthenticated remote attackers to circumvent security controls and initiate unauthorized VPN connections without requiring any credentials.<\/p>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026, reflecting the severity and confirmed in-the-wild exploitation activity.<\/p>\n

Unit 42 researchers identified an unidentified threat actor actively probing GlobalProtect-enabled devices. While the attacker successfully probed a broad set of targets, only a small portion established actual VPN sessions, resulting in gateway-connected events. No post-access behavior, lateral movement, or data exfiltration has been confirmed at this time, but the window remains open.<\/p>\n

Organizations are urged to immediately hunt for indicators of compromise (IOCs) in their GlobalProtect logs and activate incident response protocols for any successful gateway-connected events tied to the listed indicators.<\/p>\n

Organizations should immediately review the official Palo Alto Networks security advisory, apply available workarounds, or upgrade to a patched PAN-OS version. Rapid7 has also published a technical analysis of observed exploitation activity in the wild.<\/p>\n

Threat hunters should search GlobalProtect logs for successful login connections from the following IP addresses, particularly for activity predating the public PoC release on May 29, 2026:<\/p>\n

IP Address Indicators<\/p>\n

IP AddressContextPhase23.128.228[.]6Malicious source IPPre-PoC (before May 29, 2026)104.207.144[.]154Malicious source IPPre-PoC (before May 29, 2026)146.19.216[.]119Malicious source IPPre-PoC (before May 29, 2026)146.19.216[.]120Malicious source IPPre-PoC (before May 29, 2026)146.19.216[.]125Malicious source IPPre-PoC (before May 29, 2026)179.43.172[.]213Malicious source IPPre-PoC (before May 29, 2026)185.195.232[.]139Malicious source IPPre-PoC (before May 29, 2026)198.12.106[.]60Malicious source IPPre-PoC (before May 29, 2026)202.144.192[.]47Malicious source IPPre-PoC (before May 29, 2026)<\/p>\n

Host-Based Indicators<\/p>\n

IndicatorTypeContextaa:bb:cc:dd:ee:ffMAC AddressSuspicious device identifier in GlobalProtect logs00:11:22:33:44:55MAC AddressSuspicious device identifier in GlobalProtect logsWINDOWS-LAPTOP-001HostnameSuspicious host ID in GlobalProtect logsDESKTOP-GP01HostnameSuspicious host ID in GlobalProtect logsGP-CLIENTHostnameSuspicious host ID in GlobalProtect logs<\/p>\n

Post-PoC Hard-Coded Client Configuration Indicators<\/p>\n

FieldValueContextendpoint_os_versionMicrosoft Windows 10 Pro 64-bitHard-coded in PoC exploit codesource_user_info.domain(empty)Hard-coded in PoC exploit code<\/p>\n

Follow us on\u00a0Google News,\u00a0LinkedIn,\u00a0and\u00a0X\u00a0to Get More Instant Updates.<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild https:\/\/cybersecuritynews.com\/palo-alto-vpn-vulnerability-exploited\/ Publish Date:…<\/p>\n","protected":false},"author":1,"featured_media":231756,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"http:\/\/cybersecuritynews.com\/wp-content\/uploads\/2026\/06\/Palo-Alto-VPN-Vulnerability-Exploited.webp","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,31,34,27],"class_list":["post-231755","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-exploit","tag-threat-actor","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231755"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=231755"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231755\/revisions"}],"predecessor-version":[{"id":231757,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/231755\/revisions\/231757"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/231756"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=231755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=231755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=231755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}