grep -rl "CVE-2026-0257" ./articles
Unit 42 says the significant change after exploiting a PAN-OS flaw is the direct pivot to the virtualisation layer. VPN gateway to vCenter to the ESXi host, then credentials out of a VMDK that the EDR inside never sees.
Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.
CISA added this identifier to its Known Exploited Vulnerabilities catalog on 2026-05-29, which means the agency has evidence of exploitation rather than a judgement that exploitation is possible. US federal agencies were required to remediate it by 2026-06-01. CISA also records known use in ransomware campaigns.
Unit 42 says the significant change after exploiting a PAN-OS flaw is the direct pivot to the virtualisation layer. VPN gateway to vCenter to the ESXi host, then credentials out of a VMDK that the EDR inside never sees.
ReliaQuest names Qilin and a newer operation called Settra as exploiting a GlobalProtect authentication bypass that Palo Alto disclosed in May. Nothing about the vulnerability is new. What is worth reading is that patching does not close the sessions a forged cookie already opened.
../cve — every identifier we have covered