Palo Alto MCP Servers, on an Incident
A Palo Alto PSIRT dropped into an AI client, which pulls the live firewall's PAN-OS version through the MCP server and reports whether it's affected and what to do about it.
A Friday-Night CVE, Triaged in One Prompt CVE-2026-0257 · GlobalProtect authentication bypass · real prompt, real output Read the case Collapse ›
It's 5PM on a Friday when Palo Alto publishes an advisory for CVE-2026-0257, a critical GlobalProtect authentication-bypass in PAN-OS (CVSS 7.8, "highest" urgency) with limited exploitation already observed in the wild. An emergency change to patch both firewalls is already moving, but first you need the answer to one question: has anyone already tried this against us? You point your AI client (Claude) at the advisory and your read-only Panorama MCP server, and let it do the log-diving.
I completed a thorough investigation of Test-HQ-Central and Test-Branch-1 via Panorama, checking for the indicators of compromise called out in the article:
- Source IPs
23.128.228.6and104.207.144.154 - Client hostname
WINDOWS-LAPTOP-001, tied to the public PoC exploit script
Across both firewalls there is no evidence of unauthorized access attempts or successful breaches tied to this vulnerability:
- GlobalProtect logs — connections from either malicious IP, or from client
WINDOWS-LAPTOP-001: none found. - Traffic logs — transit or gateway-directed traffic matching the IoC IPs: none found.
- Threat logs — security / IPS detections involving the IPs: none found.
- System logs — VPN auth failures, portal login errors, or anomalous admin/VPN events mentioning the IPs or host: none found.
I compared each firewall's active PAN-OS version against Palo Alto's advisory for CVE-2026-0257. Both are running a fixed release:
| Firewall | Active PAN-OS | Status |
|---|---|---|
| Test-HQ-Central | 12.1.7 | Patched |
| Test-Branch-1 | 12.1.7 | Patched |
Run on lab firewalls to illustrate the workflow. The server is read-only: every answer above came from queries against Panorama, so nothing on the firewalls was changed during the investigation.
What an AI-Driven Network Can Do
Worked examples from our own lab — an AI agent paired with the directory's MCP servers, run against live gear. They're not products; they're patterns. Read how one is built, borrow the idea, and adapt it to whatever your network needs watched, checked, or correlated. The sanitized export is there if you want a head start.
All Servers
The MCP servers that wire your AI client into the network stack — a growing set, each one purpose-built for the people who run networks.
PANOS_ENABLE_WRITE=no ships it read-only.How do the Pieces Fit Together?
Background reading on the moving parts behind the servers in the directory, what they are, how they're wired, and what breaks when they aren't. Worth a skim before you run any Installation section, especially if the terminology is new.