CVE-2026-0265: Palo Alto PAN-OS Auth Bypass Vulnerability

CVE-2026-0265 Overview

CVE-2026-0265 is an authentication bypass vulnerability in Palo Alto Networks PAN-OS software. The flaw allows an unauthenticated attacker with network access to bypass authentication controls when the Cloud Authentication Service (CAS) is enabled. The weakness is classified under [CWE-347] Improper Verification of Cryptographic Signature.

The risk increases when CAS is enabled on the management interface and decreases when CAS is used on other login interfaces. The issue affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama, including virtual and M-Series appliances. Cloud NGFW and Prisma Access are not impacted.

Critical Impact

An unauthenticated network attacker can bypass authentication on PAN-OS management and login interfaces when Cloud Authentication Service is enabled, compromising confidentiality, integrity, and availability of the affected appliance.

Affected Products

• PAN-OS on PA-Series firewalls (with CAS enabled)
• PAN-OS on VM-Series firewalls (with CAS enabled)
• Panorama virtual and M-Series appliances (with CAS enabled)

Discovery Timeline

• 2026-05-13 - CVE-2026-0265 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-0265

Vulnerability Analysis

The vulnerability resides in how PAN-OS validates authentication assertions issued through the Cloud Authentication Service (CAS). CAS is the cloud-based identity broker used by PAN-OS to federate logins for administrators and end users. When CAS is enabled, PAN-OS accepts cryptographically signed authentication artifacts from the service and grants access based on their contents.

Because the underlying weakness is improper verification of a cryptographic signature, PAN-OS does not adequately validate the signature on the authentication artifact it consumes. An attacker who can reach an interface configured to use CAS can submit a crafted authentication request that PAN-OS accepts as legitimate. No prior credentials, user interaction, or privileges are required.

Successful exploitation grants administrative access to the firewall or Panorama, which permits configuration changes, policy manipulation, traffic inspection bypass, and potential pivot into the protected network.

Root Cause

The root cause is improper signature verification on authentication tokens or assertions delivered by the Cloud Authentication Service. The flaw permits an attacker to forge or modify an authentication artifact that PAN-OS treats as valid, defeating the authentication boundary entirely.

Attack Vector

The attack is performed remotely over the network against any PAN-OS login interface where CAS is enabled. The management web interface is the highest-risk surface. Exposure is significantly reduced when access to the management interface is restricted to trusted internal IP addresses, in line with Palo Alto Networks deployment best practices.

No verified proof-of-concept exploit is publicly available. The EPSS probability is 0.076% with a percentile of 22.58 as of 2026-05-17, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Palo Alto Networks Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-0265

Indicators of Compromise

• Unexpected administrative logins on PAN-OS or Panorama originating from external or untrusted IP addresses when CAS is enabled.
• Authentication events in PAN-OS system logs referencing CAS sessions without a corresponding identity provider sign-in record.
• Configuration changes, new admin accounts, or policy modifications occurring outside of approved change windows.

Detection Strategies

• Correlate PAN-OS administrative authentication logs with Cloud Authentication Service and upstream IdP logs to identify sessions that lack a valid IdP origin.
• Alert on successful logins to the management web interface from source addresses outside the documented administrative subnets.
• Hunt for sequences of authentication followed immediately by configuration commits, commit-all, or admin role changes.

Monitoring Recommendations

• Forward PAN-OS auth.log, system.log, and config.log to a centralized SIEM or data lake with retention sufficient for incident review.
• Enable alerting on new or modified administrator accounts and on changes to authentication profiles referencing CAS.
• Continuously monitor exposure of the management interface to untrusted networks using external attack surface tooling.

How to Mitigate CVE-2026-0265

Immediate Actions Required

• Apply the fixed PAN-OS versions published in the Palo Alto Networks Advisory as soon as maintenance windows permit.
• Restrict access to the PAN-OS and Panorama management web interface to trusted internal IP addresses only.
• Audit all administrator accounts, authentication profiles, and recent configuration commits for unauthorized changes.

Patch Information

Palo Alto Networks has published vendor guidance and fixed software releases in advisory CVE-2026-0265. Refer to the Palo Alto Networks Advisory for the specific fixed PAN-OS and Panorama versions applicable to each platform.

Workarounds

• Disable Cloud Authentication Service on interfaces where it is not strictly required until patches are applied.
• Limit the management interface to a dedicated out-of-band network reachable only from administrative jump hosts.
• Enforce multi-factor authentication on the upstream identity provider and monitor IdP logs for anomalies until fixes are deployed.

# Configuration example: restrict management access to trusted networks
set deviceconfig system permitted-ip 10.0.0.0/24
set deviceconfig system permitted-ip 192.168.10.5/32
commit