Researcher teases a critical GlobalProtect VPN authentication bypass

In May 2026, Hacktron AI quoted a security researcher's claim that CVE-2026-0265, an authentication bypass disclosed by Palo Alto Networks, affects GlobalProtect VPN and was rated too low. In the quoted post, researcher Harsh Jaiswal says they had already obtained VPN access to major companies and would publish details later. That is the researcher's own unverified account. Hacktron's post adds only a code screenshot and the question "what can go wrong?"

The vendor's advisory is narrower. It says an unauthenticated attacker with network access could bypass authentication on PAN-OS firewalls and Panorama when Cloud Authentication Service (CAS) is enabled, and that exposure requires a CAS authentication profile attached to a login interface. Its checks include management authentication settings and GlobalProtect gateway and portal configurations. Palo Alto Networks rates the issue high and says risk is greatest when the management interface is reachable from the internet. It lists fixed software versions, offers switching the profile to another supported method as a temporary mitigation, and says it is not aware of malicious exploitation.