cybersecurity

CVE-2026-0257 is an actively exploited authentication bypass in Palo Alto PAN-OS GlobalProtect that lets unauthenticated attackers forge session cookies and establish unauthorized VPN connections — bypassing MFA in affected configurations. CISA added it to the KEV catalog on May 29 with a federal deadline of June 19. Rapid7 MDR confirmed successful exploitation across multiple customers in two distinct waves since May 17. CVSS raised from 7.8 to 9.1 after exploitation confirmed. Patch immediately.

CISA issued a formal advisory on May 28, 2026 warning all organizations to audit developer systems for the Nx Console / GitHub supply chain compromise. CVE-2026-48027 and CVE-2026-45321 are on the CISA KEV catalog — federal deadline June 10. CISA also formally documented the parallel Megalodon campaign targeting GitHub Actions workflows. Full CISA guidance, complete attack chain, expanded credential targeting list, and forensic audit checklist inside.