Exploited vulnerabilitiesBriefConfirmed by two or more outlets
PAN-OS GlobalProtect auth bypass (CVE-2026-0257)
Fixed 13 May 2026 (PAN-SA-2026-0012). Exploited since at least 17 May.
- Disclosed
What happened
- Qilin and Inc ransomware. Chained with the PAN-OS root RCE CVE-2026-0300. Unit 42 updated its brief through 19 to 23 Oct.
- Separate bug: CVE-2026-0322 (PAN-OS code injection), KEV 14 Oct 2026.
Live scores
Live scores
CVE-2026-0257- EPSS
- 0.950
very likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2026-05-29
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-0300- EPSS
- 0.417
likely to be attacked soon - VEDAS
- 0.983
strong exploit evidence - On CISA KEV
- Yes, since 2026-05-06
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-0322- EPSS
- 0.017
some chance of attack soon - VEDAS
- 0.512
some exploit evidence - On CISA KEV
- Yes, since 2026-10-14
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
- https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.