Palo Alto's May advisory reports exploit attempts on a GlobalProtect VPN bypass for cookie-enabled firewalls
Palo Alto Networks' May 13, 2026 advisory for CVE-2026-0257 rates the 7.8-score GlobalProtect bypass at highest urgency after limited exploit attempts. Exposure needs authentication override cookies plus a specific certificate setup, and the fix costs users one re-login.
Publishers:security.paloaltonetworks.com
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence60
Huntress traces an MSP administrator's mistyped Bing search to a WatchGuard lookalike site
Huntress traced an MSP administrator's October 7 Bing search to watchguard-vpn[.]net, a WatchGuard lookalike that served a genuine signed installer. The domain was offline by October 13, and earlier WatchGuard and Microsoft reports had described fake clients.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher Proxylity's WireGuard listeners now admit strangers and hand each packet to Lambda
Two properties shipped on June 3 remove the enrollment step and the synchronous wait that kept UDP and device provisioning off serverless AWS.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence55
WatchGuard patched CVE-2026-86131, a 9.2-rated Fireware OS bug letting whoever controls a BOVPN over TLS server run root commands on connecting Fireboxes. The Firebox at risk is the tunnel client, and its safety depends on who controls the server it dials.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence65
An affiliate entered through an MFA-less SonicWall VPN, then used Safe Mode with Networking to kill endpoint controls. The encryptor ran out of virtual memory instead of running.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 65%
- Investor
- Investor 5%
Reality
- Evidence72
- Adoption15
- Hype gap+5
- Incentives40
- Confidence70
Check Point assigned the CVE identifiers and the 9.8 scores itself and shipped fixes on September 9, so there is no outside read on how reachable the bugs are. Customers on R81.10 get neither a hotfix nor Live Patch.
Perspective Coverage
5 publishers
- Builder
- Builder 15%
- Operator
- Operator 74%
- Investor
- Investor 11%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence62
Japan's Digital Agency says an intruder used a medium-severity VPN bug that already had a patch, then worked through a maintenance account on a file platform shared by 23 ministries. Disclosure came 78 days after detection.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 70%
- Investor
- Investor 7%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence70
buildOne report1 publisher An ASN.1 heap overflow puts Check Point management servers in the same patch window as the gateways
The Dutch NCSC expects mass exploitation attempts on two CVSS 9.8 Check Point VPN flaws that run code before authentication. Both sit in certificate parsing, and one of them reaches the Security Management Server.
Reality
- Evidence46
- Adoption20
- Hype gap+8
- Incentives55
- Confidence44