Attackers are actively exploiting a previously underestimated vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN, marking a significant escalation in threat activity. The authentication bypass flaw, tracked as CVE-2026-0257, initially flew under the radar before adversaries launched two distinct attack waves starting in mid-May, according to Dark Reading.
The vulnerability requires specific conditions for exploitation, but its progression from a seemingly mild issue to an urgent warning highlights how quickly threat severity can shift. Successful exploitation allows attackers to bypass authentication mechanisms, potentially compromising enterprise networks that rely on the widely deployed VPN solution.
While the immediate threat demands attention, Palo Alto Networks has also made strides in proactive defense. Its Mythos AI tool, built on Anthropic's Claude, identified at least 24 critical bugs in the company's own source code during testing earlier this year, according to Aaron Holmes reporting for The Information. The effort burned through over $1 million worth of API tokens, costs subsidized by Anthropic.
For the active exploit, Palo Alto has released patches, and organizations are urged to apply them immediately. The company is also sharing indicators of compromise to help defenders detect malicious activity stemming from the attack waves.
Some customers have indicated plans to increase spending on Mythos, signaling growing confidence in AI-driven vulnerability discovery. However, the rapid exploitation of CVE-2026-0257 serves as a reminder that even emerging detection tools cannot eliminate the need for timely patching.