United States orders urgent fixes for exploited VPN flaw
PUBLISHED Jun 1, 2026, 12:24 PM ET
Read, Watch or Listen
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered all federal civilian agencies to urgently remediate a critical authentication bypass vulnerability in Palo Alto Networks’ PAN-OS GlobalProtect VPN, tracked as CVE-2026-0257. The flaw, disclosed by Palo Alto Networks in a May 13, 2026 advisory with a CVSS score of 7.8, allows attackers to establish unauthorized VPN connections and access internal networks. CISA added the issue to its Known Exploited Vulnerabilities catalog and set a deadline of June 1, 2026 for federal agencies to patch or mitigate the flaw amid confirmed active exploitation, also urging private sector users to update systems promptly.
By James Porter | JQJO News
Timeline of Events
- May 13, 2026 Palo Alto issues vulnerability advisory
- May 13, 2026 CVE-2026-0257 score published
- Mid-May 2026 Exploitation observed in the wild
- Late May 2026 CISA reviews exploitation reports
- Late May 2026 CISA adds CVE to KEV catalog
- June 1, 2026 Federal agencies deadline for remediation
- June 1, 2026 Active exploitation targets internal networks
- Early June 2026 Private sector urged to patch
News Intelligence
- This VPN flaw could let hackers sneak into your network. If you use Palo Alto Networks' GlobalProtect VPN, you're at risk. It's not just a federal issue. Check your system and update it now.
Comments