Another GlobalProtect bypass, another reminder that the VPN is the wrong place to put your trust

The Register reported today that CVE-2026-0257 , an authentication bypass in Palo Alto’s GlobalProtect, has moved from a quiet medium-severity advisory to confirmed exploitation in the wild. Rapid7 traced successful attacks back to at least May 17 and reproduced the technique themselves. The flaw now sits in CISA’s Known Exploited Vulnerabilities catalog with a same-day patch deadline for federal agencies.