Trusting a Cookie It Never Issued: The PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)
Vulnerability Overview
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS software. A remote, unauthenticated attacker can forge an authentication override cookie and establish an unauthorized VPN connection to an affected firewall, landing inside the network perimeter the VPN exists to protect. Palo Alto Networks disclosed it on May 13, 2026 with a CVSS v4.0 score of just 4.7 (Medium). That assessment did not survive contact with reality: after Rapid7 published a technical analysis and working proof-of-concept on May 29, Palo Alto revised the score up to 7.8, and CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of June 1, 2026. Panorama and Cloud NGFW are not affected.
Do not triage this by its original "medium" rating. Exploitation has been observed in the wild since May 17, 2026, working exploit code is public, and a successful attack places an unauthenticated stranger on your internal network. If your GlobalProtect deployment meets the three configuration conditions below, treat it as urgent.
Why Edge VPN Appliances Are Prime Targets
A VPN gateway is, by definition, internet-facing and, by design, a doorway into the internal network. That combination makes GlobalProtect and its peers among the most attacked assets in the enterprise. An authentication bypass here is not a step in a chain so much as the whole chain compressed: no phishing, no malware delivery, no credential theft. The attacker simply asks the gateway for a session and the gateway agrees. Palo Alto firewalls in particular sit at the perimeter of a very large number of organizations, so a bug that produces valid VPN sessions from nothing is exactly the sort of thing opportunistic and targeted actors both prioritize.
Technical Analysis
The weakness is classified as CWE-565: Reliance on Cookies without Validation and Integrity Checking, and the mechanism is a clean example of the class. GlobalProtect supports an authentication override cookie, a convenience feature that lets a returning client skip re-authentication. The design flaw, as described in Arctic Wolf's analysis, is that vulnerable PAN-OS versions trust any authentication override cookie they can successfully decrypt, without verifying that the device itself legitimately generated it. Decryptability is treated as proof of authenticity, which it is not.
That assumption collapses when the same certificate is used both to secure the GlobalProtect HTTPS service and to encrypt the authentication override cookies. In that configuration, the key material an attacker needs is being handed to anyone who connects: they retrieve the certificate chain straight from the public-facing HTTPS service, then use it to forge a well-formed cookie for any username they like, including administrators. The firewall decrypts the forged cookie, finds it well-formed, and issues a session. Public exploit tooling automates the whole sequence, connecting to the target, extracting the certificate, and minting a cookie for a chosen user.
Exploitation depends on three configuration conditions being true at once:
| # | Required Condition |
|---|---|
| 1 | A GlobalProtect portal or gateway is enabled |
| 2 | Authentication override cookies are enabled |
| 3 | The same certificate secures both the GlobalProtect HTTPS service and authentication override cookie encryption |
Those conditions are why the initial score was modest. They are also common enough in real deployments that exploitation succeeded across numerous organizations, which is why the score moved.
Active Exploitation
Rapid7 MDR identified successful exploitation across numerous customers, with the earliest observed activity on May 17, 2026, four days after disclosure and well before the public PoC. Their telemetry showed a consistent fingerprint: Cloud Authentication Service (CAS) disabled, with authentication override cookies enabled on the portal or gateway. In the first wave, the appliance accepted forged cookies in 8 of 10 impacted MDR customers without a full VPN session being established, indicating authentication probing rather than completed access.
A second wave followed on May 21, originating from the hosting provider Dromatics Systems. Rapid7 attributes both waves to the same threat actor based on a consistent MAC address, and in this later wave observed VPN IP assignment following cookie authentication, granting actual access to the internal network. That is the difference between a probe and an intrusion.
Unit 42 confirmed active exploitation by an unidentified threat actor, noting that only a small portion of probed devices actually established VPN sessions, and that no post-access behavior or lateral movement had been identified at the time of reporting. Arctic Wolf and eSentire both reported continued exploitation into early June. The absence of observed lateral movement is a reason for cautious relief, not complacency: unauthenticated network access was demonstrably achieved.
Am I Affected?
Check the three conditions above. Palo Alto's advisory documents how to verify whether authentication override cookies are enabled: in the management interface, navigate to Network > GlobalProtect > Portals, select your portal, open the Agent tab, and inspect the agent configuration profile. Rapid7 Labs also released a proof-of-concept script that lets defenders safely validate whether an appliance is vulnerable by simulating the bypass condition under controlled circumstances. Both PAN-OS physical and virtual firewalls and Prisma Access are in scope; Panorama and Cloud NGFW are not.
Mitigation & Remediation
- Upgrade to a fixed PAN-OS release. Confirm the fixed version for your specific train against the Palo Alto Networks advisory and upgrade. Prisma Access customers are being upgraded by Palo Alto per the schedule shared with customers.
- Disable the authentication override feature. If you cannot patch immediately, turning off authentication override cookies removes the second required condition and closes the attack path.
- Or split the certificates. As an alternative workaround, generate a new certificate used exclusively for authentication override cookie encryption, so that key material is no longer exposed through the public HTTPS service. This breaks the third condition.
- Hunt using the published indicators. Review GlobalProtect logs for successful gateway-connected events from the IP addresses listed in the Unit 42 threat brief, and for suspicious host IDs or device names. Unit 42 also documented hard-coded client configuration values from the public PoC, such as a Windows 10 Pro 64-bit endpoint OS string, that make post-PoC exploitation attempts identifiable in logs.
- Treat successful gateway connections as incidents. Unit 42 advises activating incident response protocols for any successful gateway-connected event matching these indicators, since that represents an actual VPN session rather than a failed probe.
The Bigger Picture
Two lessons stand out. The first is cryptographic hygiene: reusing one certificate for two purposes turned a private signing operation into a public one. Key separation is not bureaucratic ceremony, it is the property that keeps a convenience feature from becoming an authentication bypass. The design error underneath it is subtler and more common than it looks, namely treating "I could decrypt this" as equivalent to "I must have issued this." Decryption proves a key relationship; only a validated signature or server-side session state proves authenticity.
The second lesson is about severity scores as a triage input rather than an answer. CVE-2026-0257 shipped as a 4.7 medium because its preconditions are specific, and plenty of organizations would have queued it behind bigger numbers. Attackers exploited it four days later, and the score eventually more than doubled. As Rapid7 argued, the circumstances warranted treating it as critical regardless of the rating. When a flaw sits on an internet-facing authentication boundary, the question worth asking is not what it scores, but what it grants.
References
- Palo Alto Networks - Security Advisory CVE-2026-0257
- Unit 42 - Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
- Rapid7 - Observed Exploitation and Technical Analysis
- Arctic Wolf - PAN-OS GlobalProtect Authentication Bypass
- eSentire - Threat Actors Exploit GlobalProtect Vulnerability
- Help Net Security - Exploitation Coverage
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
){kind=link}