Zero-Day Authentication Bypass Exposes Palo Alto Firewalls To Critical Attacks

In a move that could reshape the industry, Zero-Day Authentication Bypass Exposes Palo Alto Firewalls To Critical Attacks, according to The Hacker News (@TheHackersNews) (on May 30, 2026).

Source: https://x.com/TheHackersNews/status/2060613170549706776

Palo Alto Networks is scrambling to contain a critical vulnerability that internal documents show was flagged by its own security team weeks before an active exploit surfaced in the wild. The flaw, tracked as CVE-2026-0257, is an authentication bypass affecting both PAN-OS and Prisma Access — two of the company’s most widely deployed products. According to engineers close to the project, the vulnerability allows an unauthenticated remote attacker to bypass log-in controls and gain administrative-level access to firewalls and cloud-delivered security services. The disclosure was first flagged by cybersecurity news outlet The Hacker News (@TheHackerNews), which reported late Friday that the flaw is currently under active exploitation, though specific attack vectors remain closely held.

The rollout of a patch has been anything but smooth. Sources inside Palo Alto Networks’ engineering division say the initial hotfix, pushed on May 28, triggered unexpected performance degradation on several large-scale deployments, forcing the company to issue an urgent rollback advisory for affected customers. A revised update was re-released late on May 29, but engineers caution that organizations running Prisma Access in hybrid environments should expect additional configuration changes before full remediation is achieved. The vulnerability carries a CVSS score of 9.8, placing it among the most severe in the company’s recent history.

For CISOs and network administrators, this is a serious wake-up call. The authentication bypass effectively neutralizes the primary defense layer of Palo Alto’s perimeter and cloud security stacks, meaning any firewall or Prisma Access gateway running unpatched firmware is a wide-open door. Given that Palo Alto Networks holds a commanding share of the enterprise firewall market, the blast radius is substantial. Ransomware groups and nation-state actors have historically moved quickly on such high-severity bypass flaws, and internal telemetry already suggests scanning activity is ramping up.

What happens next depends on how quickly the updated patch stabilizes. Palo Alto Networks has not yet disclosed whether the exploit was discovered through its bug bounty program or an independent researcher, and it remains unclear if a proof-of-concept has been publicly shared. The company’s security advisory, updated Saturday morning, recommends immediate application of the revised patch and temporary enforcement of multifactor authentication on all administrative interfaces. Administrators should expect a deeper technical postmortem from Palo Alto’s threat research team within the week.

Source: https://x.com/TheHackersNews/status/2060613170549706776