CVE-2026-0257: Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass via Cookie Forgery

Background

CVE-2026-0257 is an authentication bypass vulnerability in the Palo Alto Networks PAN-OS GlobalProtect portal and gateway components. It is classified CWE-565 (Reliance on Cookies without Validation and Integrity Checking) and carries a CVSSv4 score of 7.8. Despite the Medium-range score, the vulnerability is being treated as critical-priority across the industry due to its position on internet-facing enterprise VPN infrastructure and the trivial exploitation path available to unauthenticated remote attackers.

The vulnerability was added to the CISA Known Exploited Vulnerabilities catalogue on May 29, 2026, with a federal agency remediation deadline of June 1, 2026. Rapid7 MDR has confirmed active exploitation in the wild since May 17, 2026 across multiple customer environments, with attackers successfully establishing unauthorised VPN tunnel access.

Patches are available. Organisations that cannot patch immediately have two viable workarounds.

Technical Mechanism

GlobalProtect’s authentication override feature allows the portal to issue an encrypted cookie to a successfully authenticated client. On subsequent connections, the client presents this cookie and GlobalProtect accepts it without re-challenging the user for credentials. This is a legitimate feature designed to improve user experience by reducing re-authentication prompts for already-verified users.

The flaw is in how PAN-OS handles the cryptographic material for these cookies in certain configurations. When a GlobalProtect portal or gateway reuses a TLS certificate across the authentication override function and another PAN-OS feature (such as HTTPS services), the certificate’s public key is accessible to any external party — that is what a public key is for. The vulnerability is that the authentication override cookie encryption relies on this same key material in a way that allows an attacker in possession of only the public key to construct a valid, accepted cookie from scratch.

The specific CWE-565 classification is precise: the server-side validation does not confirm the integrity or origin of the presented cookie beyond verifying it can be decrypted with the expected key. There is no server-side binding to a prior legitimate authentication event, no session nonce, no user-specific derivation that the forger cannot replicate. An attacker who can enumerate the certificate (straightforward for any internet-facing GlobalProtect endpoint) can craft a cookie that the server accepts as valid, bypassing authentication entirely.

The practical result: the attacker receives a VPN tunnel assignment as if they were a legitimately authenticated user. What the attacker can access beyond that depends on network segmentation, split tunnelling configuration, and post-connection access controls.

Note that the attack requires authentication override cookies to be enabled and requires the certificate reuse condition. Deployments using dedicated certificates exclusively for the authentication override function and no other PAN-OS feature are not vulnerable under the current advisory description.

# CVE-2026-0257: GlobalProtect authentication override cookie forgery
# Step 1 — Attacker retrieves the server's TLS certificate to extract the public key
# (Performed against any internet-facing GlobalProtect portal)
GET /global-protect/prelogin.esp HTTP/1.1
Host: vpn.target.example.com
User-Agent: PAN GlobalProtect/6.0.0

# Step 2 — Attacker crafts a forged authentication override cookie using the
# public key extracted from the certificate (CWE-565: no signing or session binding)
# The forged cookie encodes an arbitrary username (e.g., a known admin account)
POST /ssl-vpn/login.esp HTTP/1.1
Host: vpn.target.example.com
Content-Type: application/x-www-form-urlencoded

user=administrator&passwd=&inputStr=&clientVer=4100&clientos=Windows&os-version=Microsoft+Windows+10+Pro&server-cert-ignore=yes&preferred-ip=&prelogonuserauthcookie=&portal-userauthcookie=<forged-cookie-value>

# Step 3 — Successful response establishes a VPN tunnel as the impersonated user
# without any valid password having been presented

Real-World Exploitation Evidence

Rapid7 MDR identified active exploitation beginning May 17, 2026, originating from a Vultr-hosted IP address. A second exploitation wave was observed on May 21, 2026, using infrastructure under Dromatics Systems. The consistency of TTPs across both waves suggests a single threat actor rotating hosting providers between campaigns.

Rapid7’s lab environment confirmed a working proof-of-concept of the cookie forgery mechanism independently of observed exploitation. The PoC validates that the described attack path requires no special tooling or privileges — a standard HTTPS client and knowledge of the target certificate is sufficient.

Across affected Rapid7 MDR customers, confirmed post-exploitation observations include:

• VPN tunnel establishment using forged cookies, granting authenticated-equivalent network access
• Lateral reconnaissance consistent with initial access objectives (probing internal subnet addressing and active services)
• No confirmed lateral movement or data exfiltration had been attributed as of the CISA KEV listing date, though access was established

The CISA addition date of May 29 — twelve days after first observed exploitation — suggests the vulnerability moved quickly from targeted exploitation to broader campaign activity sufficient to trigger the KEV threshold.

The compressed federal deadline of June 1 (three days post-listing, rather than the standard 14-21 day window) is a strong signal of assessed exploitation risk.

Impact Assessment

Authentication bypass on a VPN gateway establishes an attacker-controlled client as a trusted VPN peer, receiving the same network access as legitimate users. The effective impact depends on network segmentation and split tunnelling configuration — in poorly segmented environments, VPN access translates directly to internal resource access.

GlobalProtect is typically deployed on the internet perimeter as the primary remote access gateway, making it a high-value target for initial network access. Confirmed exploitation since May 17 predates the advisory by twelve days, meaning attackers had undetected network access in affected environments throughout that window. The attack’s passive footprint — no failed authentication events, no credential guessing noise — makes historical detection difficult and complicates the scope of any forensic investigation.

Affected Versions

The vulnerability affects PAN-OS deployments running GlobalProtect portal or gateway with the authentication override cookie feature enabled and a specific misconfiguration: the same certificate is used for authentication override cookie encryption and at least one other PAN-OS feature.

Confirmed affected and patched versions:

Refer to the Palo Alto Networks security advisory (linked below) for the complete version matrix, as additional versions may be covered. Panorama and Cloud NGFW are not affected.

Remediation Steps

1. Patch first. For organisations able to schedule maintenance, applying the vendor-supplied hotfix is the definitive remediation.

   • PAN-OS 10.2.7: upgrade to 10.2.7-h34 or later
   • Prisma Access 10.2.10: upgrade to 10.2.10-h36 or later
   • Prisma Access 11.2.7: upgrade to 11.2.7-h13 or later

   # Check current PAN-OS version via CLI
   show system info | match "sw-version"
   
   # Install hotfix via PAN-OS CLI (requires maintenance window)
   request system software install version 10.2.7-h34
   request restart system
   
   # Verify after restart
   show system info | match "sw-version"

2. Workaround Option 1 — Dedicated certificate. If you must defer patching, generate a new certificate exclusively for the GlobalProtect authentication override feature and do not share it with any other PAN-OS functionality. This removes the certificate reuse condition that enables cookie forgery. This is the workaround recommended by Palo Alto Networks for environments where immediate patching is not feasible.

   # Generate a dedicated self-signed certificate for auth override only (PAN-OS CLI)
   request certificate generate signed-by <internal-CA> certificate-name GP-AuthOverride-Cert \
       algorithm RSA nbits 2048 digest sha256 \
       subject-alt-name type "IP" value "<gateway-IP>"
   
   # Then in Panorama/GUI:
   # Network → GlobalProtect → Portals → <portal> → Authentication → Cookie Authentication
   # Set "Certificate for Encrypting/Decrypting Cookie" to "GP-AuthOverride-Cert"
   # Ensure this cert is NOT used under Device → Certificate Management → SSL/TLS Service Profile

3. Workaround Option 2 — Disable authentication override. Disable the authentication override option in GlobalProtect portal and gateway configuration. This eliminates the attack surface entirely at the cost of additional user re-authentication prompts. For high-security environments or where the certificate reuse condition cannot be immediately resolved, this is the more conservative option.

4. Additional hardening, regardless of patch status:

   • Restrict GlobalProtect portal and gateway exposure using upstream ACLs where feasible (limit to expected source IP ranges for managed devices)
   • Require client certificate authentication in addition to user credentials as a compensating control
   • Enable connection rate limiting on GlobalProtect endpoints to slow opportunistic scanning

Detection Guidance

Log sources. The primary detection surface is GlobalProtect authentication and tunnel establishment logs. Enable verbose logging on portal and gateway interfaces if not already configured, and forward logs to your SIEM.

Anomaly indicators. Authentication bypass via forged cookie leaves characteristic gaps in the authentication log chain. Look for:

• VPN tunnel establishment events that do not have a corresponding preceding authentication success event in the same session
• GlobalProtect sessions originating from IP addresses not previously associated with the user account
• Session establishment from geographies or ASNs inconsistent with the user’s normal access pattern
• Multiple rapid connection attempts from a single source, consistent with probing and then bypassing authentication

SIEM detections. Rapid7 InsightIDR customers have detection rules available covering this specific bypass pattern, including “Suspicious Authentication — Palo Alto GlobalProtect Cookie Authentication to Local Admin Account” and “VPN Authentication via Spoofed MAC Address.”

Threat hunting query. Cross-correlate GlobalProtect tunnel establishment events against authentication logs. Any tunnel session with no matching auth event within a configurable lookback window (15 minutes is reasonable) is a candidate for investigation.

index=panos sourcetype="pan:globalprotect"
| eval session_id=coalesce(session_id, tunnel_id)
| eval event_type=if(match(_raw, "Gateway-Auth"), "auth", if(match(_raw, "Gateway-Connected"), "tunnel", "other"))
| transaction session_id maxspan=15m startswith=(event_type="auth") endswith=(event_type="tunnel")
| where NOT started
| eval suspicious="tunnel_with_no_preceding_auth"
| table _time, src_ip, user, session_id, suspicious, dst
| sort -_time

alert tcp any any -> $EXTERNAL_NET 443 (msg:"CVE-2026-0257 GlobalProtect Auth Override Cookie Forgery Attempt"; flow:established,to_server; tls.sni; content:"globalprotect"; nocase; http.uri; content:"/ssl-vpn/login.esp"; nocase; http.request_body; content:"portal-userauthcookie="; pcre:"/portal-userauthcookie=[A-Za-z0-9+\/=]{50,}/"; sid:9002210; rev:1;)
alert tcp any any -> $EXTERNAL_NET 443 (msg:"CVE-2026-0257 GlobalProtect Prelogin Cert Enumeration"; flow:established,to_server; http.uri; content:"/global-protect/prelogin.esp"; nocase; threshold:type threshold, track by_src, count 5, seconds 60; sid:9002211; rev:1;)

IOC infrastructure. The exploitation waves Rapid7 observed used Vultr and Dromatics Systems hosted infrastructure. IP-based blocks on known scanner and hosting ASNs provide marginal value — motivated attackers rotate infrastructure — but bulk blocking of hosting ASN ranges on GlobalProtect intake may reduce opportunistic hit rate.

Timeline

References

• Palo Alto Networks Security Advisory — CVE-2026-0257
• Rapid7 — Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)
• NVD — CVE-2026-0257
• CISA KEV Catalog
• CWE-565: Reliance on Cookies without Validation and Integrity Checking