PAN-OS VPN Bypass: Zero Trust Lessons from a Perimeter KEV
CISA added CVE-2026-0257 to the Known Exploited Vulnerabilities catalog on May 29, 2026. The vulnerable product is Palo Alto Networks PAN-OS, and CISA describes the impact as an authentication bypass that can allow attackers to establish an unauthorized VPN connection.
That single sentence should change the defender mindset. A VPN connection is not a user. It is not a managed device. It is not proof of MFA. It is a network path that still has to be correlated against identity, device posture, and behavior.
What to do first
Start with exposure and evidence:
- Identify every PAN-OS device and GlobalProtect portal/gateway in scope.
- Compare versions against the Palo Alto Networks advisory for CVE-2026-0257.
- Export VPN session logs for the exposure window.
- Correlate sessions with IdP events, MFA events, device posture checks, and geo-location.
- Raise temporary scrutiny on traffic from VPN zones to RDP, SMB, WinRM, SSH, vCenter, management panels, code repositories, and cloud consoles.
If a VPN session exists without a matching identity event, that is not a weird logging artifact until proven otherwise. It is an incident lead.
Detection logic
Useful hunts include:
- VPN session creation with no corresponding SAML/OIDC login event.
- New source ASNs or countries for known users.
- Device fingerprint changes for privileged accounts.
- Short VPN sessions followed by internal scanning.
- VPN-origin traffic to domain controllers, file shares, hypervisors, and jump hosts.
- Logins outside normal work hours followed by privilege-sensitive internal access.
The best output is not a giant dashboard. It is a short list of suspicious sessions with user, device, source, destination, time, and confidence.
The zero trust lesson
Many organizations still treat VPN as the safe side of the wall. That model breaks whenever perimeter access is bypassed, credentials are phished, device checks are weak, or split tunneling hides context.
The better design is:
- Identity-aware access to applications, not broad subnet access.
- Device posture checks before sensitive apps.
- Short-lived sessions and reauthentication for privileged paths.
- Segmentation between VPN users and management networks.
- Full east-west logging from remote-access zones.
Zero trust is not a slogan. It is the refusal to let one successful network control unlock the rest of the estate.