iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Palo Alto Networks says attackers are actively targeting CVE-2026-0257, an authentication-bypass flaw in GlobalProtect portal and gateway components. Administrators should identify affected PAN-OS deployments, upgrade each to a fixed release for its maintenance train, and investigate GlobalProtect logs for successful gateway connections from suspicious hosts or device names.
What CVE-2026-0257 does—and what is known about exploitation
Palo Alto Networks Unit 42 describes CVE-2026-0257 as an authentication bypass in GlobalProtect portal and gateway components. An unauthorised attacker could circumvent security controls and initiate VPN connections. Palo Alto Networks rates the vulnerability CVSS 7.8. Unit 42 reported active exploitation attempts by an unidentified threat actor and said CISA added the CVE to its Known Exploited Vulnerabilities catalog on May 29, 2026.
Unit 42 said only a small portion of probed devices established VPN sessions. As of its June 9, 2026 update, it had not identified post-access activity or lateral movement. Those observations are time-bounded: they do not establish that no such activity occurred later, and the available reporting does not give a reliable total of affected organisations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which PAN-OS versions are affected, and what fixes them?
The affected release branches are PAN-OS 12.1, 11.2, 11.1 and 10.2. The fixed release depends on the maintenance train within a branch. Upgrade to the applicable release below or a later fixed release in that train; do not assume that a version number from a different train is an equivalent fix.
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
| PAN-OS branch | Fixed release thresholds listed by Palo Alto Networks |
|---|---|
| 12.1 | 12.1.4-h6 or later, including later listed maintenance trains |
| 11.2 | 11.2.4-h17; 11.2.7-h14; 11.2.10-h7; or 11.2.12 and later |
| 11.1 | 11.1.4-h33; 11.1.6-h32; 11.1.7-h6; 11.1.10-h25; 11.1.13-h5; or 11.1.15 and later |
| 10.2 | 10.2.7-h34; 10.2.10-h36; 10.2.13-h21; 10.2.16-h7; or 10.2.18-h6 and later |
Before scheduling an upgrade, verify the exact fixed release against Palo Alto Networks’ current CVE-2026-0257 advisory and the firewall’s maintenance train. The thresholds above are the releases listed in the advisory information available for this article; the advisory may be updated.
What administrators should do
- Inventory the affected deployments. Identify every firewall running PAN-OS in one of the affected branches, along with GlobalProtect portals and gateways and any Prisma Access deployment that may be in scope.
- Prioritise exposed services. Determine which portals or gateways are internet-exposed and prioritise those for remediation. Restricted access can reduce exposure while a change window is pending, but it does not replace upgrading to a fixed release.
- Upgrade to the applicable fix. Use the fixed release for the device’s exact maintenance train. Apply Palo Alto Networks’ advisory workarounds or mitigations where an upgrade cannot be completed immediately.
- Review GlobalProtect activity. Hunt for indicators described in the Unit 42 brief and for successful gateway-connected events associated with suspicious source hosts or device names. Correlate those events with the relevant accounts and subsequent sessions.
- Escalate successful suspicious connections. Treat a suspicious successful gateway connection as an incident-response trigger. Investigate whether an account or session was used after access, and follow your organisation’s incident-response procedures.
What to check in GlobalProtect logs
Focus on evidence of access, not just evidence that a host probed a portal. Review the GlobalProtect log records against the indicators in Unit 42’s brief, then look for successful gateway-connected events tied to suspicious hosts or device names. For each candidate event, preserve and correlate the timestamp, source host or device name, account, and related session activity available in your logs.
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
- A probe or failed attempt: evidence of targeting, but not by itself proof that a VPN session was established.
- A successful gateway-connected event: a higher-priority signal that requires investigation, especially when its host or device name is suspicious.
- Activity after the connection: check whether the account or session was used for further access. Unit 42’s June 9 statement that it had not identified post-access behavior or lateral movement describes what it had observed at that time, not a guarantee about an individual deployment.
Use the specific indicators published in Unit 42’s brief rather than relying on generic searches alone. The advisory information available here does not enumerate those indicator values, so no particular IP address, device name, or log string is reproduced here.
Quick Recap
Best Value
- MADE FOR THE MAKERS: Create; Explore; Store; The T7 Portable SSD delivers fast speeds and durable features to back up any endeavor; Build your video editing empire, file your photographs or back up your blogs all in an instant
- SHARE IDEAS IN A FLASH: Don’t waste a second waiting and spend more time doing; The T7 is embedded with PCIe NVMe technology that brings fast read and write speeds up to 1,050/1,000 MB/s¹, making it almost twice as fast as the T5
- ALWAYS MAKE THE SAVE: Compact design with massive capacity; With capacities up to 4TB, save exactly what you need to your drive – from large working files to game data and everything in between
- ADAPTS TO EVERY NEED: Whether using a PC or mobile phone, count on the T7 for extensive compatibility²; It’s a true team player when it comes to heavy-duty application usage or file-saving
- HI RESOLUTION VIDEO RECORDING: Record Ultra High Resolution (4K 60fs) videos directly onto the T7 Portable SSD with your favorite camera or mobile devices; Supports iPhone 15 Pro Res 4K at 60fps video and more³
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Rank #3
- Capacity Display Variance: 500GB external ssd often appears as around 465GB on Windows. MacOS can show full 500 GB capacity. This is binary calculation difference and doesn’t affect SSD hard drive actual physical storage
- 1050 MB/s Speed: Instantly access to your files with blazing-fast 10Gbps external SSD read up to 1050MB/s and write up to 1000MB/s. LED Light indicates USB SSD instant activity
- Data Security: Solid state drives S.M.A.R.T. health diagnostics and adaptive TRIM optimizing data block management ensures consistent write speeds and extends the longevity of the portable SSD
- USB-C & USB-A Cable: Both cables featuring rapid USB 3.2 Gen2, this USB SSD effortlessly bridges devices, enabling seamless cross-platform file transfers and backup between computers, smartphones, tablets and iPhone
- Always Fast: No slowdowns for large file transfers. With SLC caching (25% of current available capacity allocated as high-speed cache), this external SSD delivers steady 10Gbps for transfers within the cache capacity
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
