Critical and Already Being Exploited: PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)

by

Author: VulnTracker
Published: June 2, 2026
Source: https://vulntracker.io/blog/palo-alto-globalprotect-auth-bypass-cve-2026-0257-actively-exploited

Summary

VulnTracker reports on CVE-2026-0257, a CVSS 9.1 critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect that is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. A remote, unauthenticated attacker can bypass authentication and establish a VPN connection into the network — but only when a specific configuration is present. The article’s central point is that the CVE reaches an environment only if two conditions both hold, so triage depends on configuration, not just the CVE ID. Panorama and Cloud NGFW are not affected.

Technical Details

The vulnerability is an authentication bypass in the GlobalProtect portal and gateway. Its root cause is a broken trust assumption in GlobalProtect’s authentication override feature, which issues a cookie so users do not re-enter credentials on every connection (conceptually similar to a bearer token). The appliance decrypts that cookie with a private key but never verifies a signature on the decrypted contents. Consequently, if an attacker can learn the public key tied to the certificate used for these cookies, they can forge a valid override cookie for any user — including an administrator. The weakness is classified as CWE-565 (reliance on cookies without integrity checking).

Exploitability hinges on two conditions that must both be true: (1) authentication override must be enabled on the GlobalProtect portal or gateway — it is not on by default; and (2) the certificate used to encrypt/decrypt the override cookies must be reused elsewhere, such as for the portal or gateway’s own HTTPS service. That certificate reuse is what allows an attacker to recover the public key remotely and forge cookies. If a dedicated certificate is used exclusively for authentication override, the article states an attacker has no way to derive the key.

Impact

Successful exploitation gives a remote, unauthenticated attacker a valid VPN session into the target network, forging cookies for arbitrary users up to admin. Per the article, Rapid7’s MDR team observed successful exploitation across multiple customers starting May 17, 2026, with a second wave on May 21 attributed to the same actor based on a consistent spoofed MAC address; traffic originated from low-cost hosting providers, a pattern typical of opportunistic scanning campaigns. A public proof-of-concept exists. Affected surface is PAN-OS GlobalProtect portal and gateway plus Prisma Access; Panorama and Cloud NGFW are not affected.

Mitigation

Palo Alto Networks has shipped fixes across the 10.2, 11.1, 11.2, and 12.1 trains plus Prisma Access; minimum fixed builds vary by branch, so the article advises checking your exact build against the vendor advisory rather than assuming. For those who cannot patch immediately, two workarounds are offered: disable authentication override entirely, or generate a new certificate used only for authentication override cookies and stop sharing it with any other feature. Note that after patching, GlobalProtect users will need to re-authenticate once, because the fix regenerates cookies using a more secure method.

References

Leave a Comment