United States orders urgent fixes for exploited VPN flaw
Tap title to read story
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal civilian agencies to urgently remediate a critical authentication bypass vulnerability in Palo Alto Networks’ PAN-OS GlobalProtect VPN, tracked as CVE-2026-0257. The flaw, disclosed by Palo Alto Networks in a May 13, 2026 advisory with a CVSS score of 7.8, allows attackers to establish unauthorized VPN connections and access internal networks. CISA added the issue to its Known Exploited Vulnerabilities catalog and set a deadline of June 1, 2026 for federal agencies to patch or mitigate the flaw amid confirmed active exploitation, also urging private sector users to update systems promptly.
More context
Timeline
- May 13, 2026 Palo Alto issues vulnerability advisory
- May 13, 2026 CVE-2026-0257 score published
- Mid-May 2026 Exploitation observed in the wild
- Late May 2026 CISA reviews exploitation reports
- Late May 2026 CISA adds CVE to KEV catalog
- June 1, 2026 Federal agencies deadline for remediation
- June 1, 2026 Active exploitation targets internal networks
- Early June 2026 Private sector urged to patch
Why it matters
This VPN flaw could let hackers sneak into your network. If you use Palo Alto Networks' GlobalProtect VPN, you're at risk. It's not just a federal issue. Check your system and update it now.
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.











