{ "Event": { "analysis": "1", "date": "2026-06-09", "extends_uuid": "", "info": "[Threat Intel] Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257", "protected": false, "publish_timestamp": "1781329206", "published": true, "threat_level_id": "3", "timestamp": "1781329206", "uuid": "cb68fa3e-8825-4e7f-9b37-14ef05ad6173", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0afe32", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"", "relationship_type": "" }, { "colour": "#866c0c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Active Scanning - T1595\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"vulnerability\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780916415", "to_ids": false, "type": "link", "uuid": "f962a370-0934-4927-b95b-8ff5ffe8940d", "value": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780916415", "to_ids": false, "type": "text", "uuid": "0d42daa7-3e7c-4de9-8ff2-0483e5d70904", "value": "An unidentified threat actor is actively exploiting CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect portal and gateway components. The flaw allows unauthorized attackers to circumvent security controls and initiate VPN connections. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on May 29, 2026. Exploitation activity has been detected targeting GlobalProtect, with a small portion of probed devices successfully establishing VPN sessions. No post-access behavior or lateral movement has been identified. Organizations are advised to hunt for indicators including specific IP addresses, suspicious host IDs, and MAC addresses. Palo Alto Networks recommends following security advisory guidance, implementing available workarounds, and upgrading to patched versions." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780916415", "to_ids": false, "type": "text", "uuid": "8b6466bb-7b91-4a23-8854-99d856a12d3a", "value": "Name: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257\nAuthor: AlienVault\nAdversary: \nTags: [\"pan-os\", \"globalprotect\", \"authentication bypass\", \"cve-2026-0257\", \"gateway compromise\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1133\", \"T1082\", \"T1071\", \"T1190\", \"T1595.002\", \"T1595\", \"T1016\", \"T1087\", \"T1078\", \"T1046\"]\nIndustries: []" }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1781323909", "to_ids": true, "type": "ip-dst", "uuid": "741e4fe0-1d5d-4bfb-b18b-521c39d22c08", "value": "198.12.106.60", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS20473 the constant company llc", "deleted": false, "disable_correlation": false, "timestamp": "1781323930", "to_ids": true, "type": "ip-dst", "uuid": "dc8d725e-6ece-43f4-b5ec-201e0216c0fe", "value": "104.207.144.154", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS1239 sprint", "deleted": false, "disable_correlation": false, "timestamp": "1781323951", "to_ids": true, "type": "ip-dst", "uuid": "b0ad1d1f-3951-4bcc-ac2d-04372dae7d5c", "value": "146.19.216.119", "Tag": [ { "colour": "#7e6d56", "local": false, "name": "asn:asn=\"134677\"", "relationship_type": "" }, { "colour": "#7769fe", "local": false, "name": "asn:as-owner=\"IDC-AS-AP Dromatics Systems Pte Ltd\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS1239 sprint", "deleted": false, "disable_correlation": false, "timestamp": "1781323972", "to_ids": true, "type": "ip-dst", "uuid": "30bdd40e-6f3b-4a88-a96b-34761cb5e78b", "value": "146.19.216.125", "Tag": [ { "colour": "#7e6d56", "local": false, "name": "asn:asn=\"134677\"", "relationship_type": "" }, { "colour": "#7769fe", "local": false, "name": "asn:as-owner=\"IDC-AS-AP Dromatics Systems Pte Ltd\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS1239 sprint", "deleted": false, "disable_correlation": false, "timestamp": "1781323993", "to_ids": true, "type": "ip-dst", "uuid": "da5e1eca-0a6c-4f45-a1ea-874edd454e06", "value": "146.19.216.120", "Tag": [ { "colour": "#7e6d56", "local": false, "name": "asn:asn=\"134677\"", "relationship_type": "" }, { "colour": "#7769fe", "local": false, "name": "asn:as-owner=\"IDC-AS-AP Dromatics Systems Pte Ltd\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780916415", "to_ids": false, "type": "vulnerability", "uuid": "491b9b70-1d38-4767-a261-6d92d7400d58", "value": "CVE-2026-0257" }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1781324014", "to_ids": true, "type": "ip-dst", "uuid": "073d631e-bb8a-489a-ac8b-2ea5866ac00f", "value": "23.128.228.6", "Tag": [ { "colour": "#a66e9e", "local": false, "name": "asn:asn=\"138997\"", "relationship_type": "" }, { "colour": "#6dec9e", "local": false, "name": "asn:as-owner=\"EDCL-AS-AP Eons Data Communications Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=CH ASN=AS51852 private layer inc", "deleted": false, "disable_correlation": false, "timestamp": "1781324035", "to_ids": true, "type": "ip-dst", "uuid": "bbe755cd-90ec-4553-b676-5768e329e266", "value": "179.43.172.213", "Tag": [ { "colour": "#be4b17", "local": false, "name": "asn:asn=\"51852\"", "relationship_type": "" }, { "colour": "#39e6e7", "local": false, "name": "asn:as-owner=\"PLI-AS\"", "relationship_type": "" }, { "colour": "#5a7dcf", "local": false, "name": "asn:as-country=\"PA\"", "relationship_type": "" }, { "colour": "#f31b7b", "local": false, "name": "misp-galaxy:country=\"panama\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=GB ASN=AS39351 31173 services ab", "deleted": false, "disable_correlation": false, "timestamp": "1781324057", "to_ids": true, "type": "ip-dst", "uuid": "d0130e06-0682-4604-85b3-a0676b56d8d8", "value": "185.195.232.139", "Tag": [ { "colour": "#2a9c58", "local": false, "name": "asn:asn=\"39351\"", "relationship_type": "" }, { "colour": "#0cf72d", "local": false, "name": "asn:as-owner=\"ESAB-AS\"", "relationship_type": "" }, { "colour": "#f213f8", "local": false, "name": "asn:as-country=\"SE\"", "relationship_type": "" }, { "colour": "#c6e2d5", "local": false, "name": "misp-galaxy:country=\"sweden\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=JP ASN=AS63916 iptelecom global", "deleted": false, "disable_correlation": false, "timestamp": "1781324078", "to_ids": true, "type": "ip-dst", "uuid": "ed56e20f-18a6-4113-889d-83c0d349e98b", "value": "202.144.192.47", "Tag": [ { "colour": "#8cc040", "local": false, "name": "asn:asn=\"63916\"", "relationship_type": "" }, { "colour": "#3ed617", "local": false, "name": "asn:as-owner=\"IPTELECOM-AS-AP IPTELECOM Global\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }