CVE-2026-0257 PAN-OS GlobalProtect Auth Bypass: Fixed Versions, Mitigation and Log Hunting

Published: June 11, 2026 | Updated: October 29, 2026 | Affects: PAN-OS GlobalProtect portal and gateway, Prisma Access | CVSS v4: 7.8 (High) | CISA KEV: added May 29, 2026, ransomware use “Known”

CVE-2026-0257 lets an unauthenticated attacker open a GlobalProtect VPN connection by presenting a forged authentication override cookie. This page is a working checklist for Palo Alto firewall admins: who is exposed, which build to move to, what to change if you cannot patch yet, and what to look for in your logs. Nothing here comes from my own lab testing. Every fact is checked against the vendor advisory, Rapid7, Unit 42 and CISA, linked at the bottom.

What changed since June

• May 13: Palo Alto Networks publishes the advisory. Rapid7 reports the first score as CVSS v4 4.7 (Medium); the advisory now shows 7.8 (High) with exploit maturity “Attacked”.
• May 17 to 21: Rapid7 sees two waves of successful exploitation against its MDR customers.
• May 29: CISA adds the CVE to the Known Exploited Vulnerabilities catalog with a June 1 due date.
• October 19: Unit 42 updates its threat brief: ransomware operators are now using this bug, including the groups it tracks as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc). The CISA catalog now flags known ransomware campaign use.

If you read an earlier version of this post, the main correction is this: in June there was no confirmed activity after the VPN login. That is no longer true. Unit 42 describes internal reconnaissance with remote-management tools, lateral movement over RDP and SMB, and in one case a pivot from the VPN gateway to a vCenter appliance and ESXi hosts. It also reports the bug being chained with Veeam CVE-2023-27532. Treat an unpatched or late-patched GlobalProtect gateway as a possible intrusion point, not only as a patching task.

What the flaw is

GlobalProtect can issue an authentication override cookie after a successful login, so returning users skip the full authentication step. PAN-OS does not properly validate these cookies (CWE-565, reliance on cookies without validation and integrity checking). Rapid7’s analysis adds that the problem needs the certificate used to encrypt and decrypt the override cookie to be reused for another feature, such as the HTTPS service. An attacker who can obtain that certificate’s public key can forge cookies the firewall trusts.

The advisory lists the conditions for exposure: a GlobalProtect portal or gateway is configured, authentication override cookies are enabled, and a specific certificate configuration exists. The attack needs no privileges and no user interaction. Panorama and Cloud NGFW are not affected.

Rapid7 also noted that Cloud Authentication Service was disabled on the appliances it investigated. That is something it observed, not a condition the advisory lists, so do not treat CAS as protection.

Fixed versions

Find your maintenance train in the table and move to the listed build or any later build. This matches the advisory as last updated on June 3, 2026. Check the advisory again before you plan the change, because Palo Alto can update it.

Example: a firewall on 11.2.7-h5 needs 11.2.7-h14 or later, or a move to a newer train. The advisory has no rows for PAN-OS 11.0 or 10.1. If you are on one of those, plan an upgrade to a supported train. Prisma Access is upgraded by Palo Alto on a schedule shared with each customer.

One side effect from the advisory: after the upgrade, GlobalProtect users must authenticate again once, even if they hold a valid cookie.

Check whether you are exposed

1. Portal: Network, GlobalProtect, Portals, your portal, Agent, your agent config, Authentication tab. Look at “Generate cookie for authentication override” and “Accept cookie for authentication override”.
2. Gateway: Network, GlobalProtect, Gateways, your gateway, Agent, Client Settings, your config, Authentication Override tab. Look at “Accept cookie for authentication override”. Menu labels can differ slightly between versions.
3. Certificate: note which certificate is selected for cookie encryption and check whether the portal, the gateway or any other service uses the same one.
4. Version: from the CLI, show system info | match sw-version, then compare with the table above.

Mitigate if you cannot patch today

The advisory gives two workarounds:

• Use a dedicated certificate for authentication override cookies. Generate a new certificate used only for this purpose, store it securely, and do not reuse the portal or gateway certificate or share it with any other feature. Users keep the cookie convenience.
• Disable authentication override. Uncheck the generate and accept cookie options on the portal and gateway, then commit. Users will go through the full authentication flow on every connection, including MFA.

Both are stop-gaps. The permanent fix is the upgrade. On an HA pair, upgrade the passive unit first, fail over, then upgrade the other.

What to look for in your logs

Search Monitor, Logs, GlobalProtect on the firewall, going back to at least May 13, 2026, and check these patterns published by Rapid7 and Unit 42:

• A gateway-auth login with authentication method Cookie and result success, especially for a local account such as admin, from an external address.
• The spoofed MAC address aa:bb:cc:dd:ee:ff (Unit 42 also lists 00:11:22:33:44:55).
• Client or host names GP-CLIENT, DESKTOP-GP01, WINDOWS-LAPTOP-001 and Jocker.
• Requests to /ssl-vpn/login.esp carrying a portal-userauthcookie or portal-prelogonuserauthcookie value, followed by /ssl-vpn/hipreport.esp and /ssl-vpn/getconfig.esp when a tunnel was established.
• Unit 42 also points to successful gateway logins reporting the endpoint OS “Microsoft Windows 10 Pro 64-bit” with an empty source user domain.

Source addresses named in the two reports (defanged):

23.128.228[.]6      79.130.26[.]202     104.207.144[.]154
146.19.216[.]119    146.19.216[.]120    146.19.216[.]125
179.43.172[.]213    185.195.232[.]139   198.12.106[.]60
202.144.192[.]47    209.99.191[.]137

Address lists age quickly, so use them to confirm a compromise, not to prove you are clean. A cookie login to a local account is suspicious on its own. If you find a hit, treat it as an incident and look at what that VPN address did next: RDP or SMB to other hosts, new remote-management tools, access to vCenter, ESXi or backup servers.

Unit 42’s October 20 update also asks admins to check for a separate exposure: GlobalProtect profiles mapped to HTTP or HTTPS services on management interfaces, which can expose the management interface on ports 4443 and 3879. Test with an out-of-band HTTPS connection to the management IP and restrict access with Interface Management profiles.

Quick reference

Lessons for the rest of your VPN setup

• Audit certificate reuse. One certificate doing several jobs is common on Palo Alto deployments because it is convenient. Give security-critical features their own certificate.
• Do not allow local admin accounts on the VPN. Rapid7 saw the attacker log in as admin. Authenticate GlobalProtect users against your directory or SAML provider, not local accounts.
• Put VPN users in their own zone. A VPN address is trusted by design. Limit what the VPN pool can reach so one forged login does not reach vCenter, backups and domain controllers.
• Treat a KEV entry as a deadline. CISA’s due date was June 1. If you patched later than that, hunt back to May.

Related: Cisco to Palo Alto IKEv2 VPN configuration.

Sources

• Palo Alto Networks security advisory, CVE-2026-0257
• Unit 42 threat brief, active exploitation of CVE-2026-0257
• Rapid7, observed exploitation of CVE-2026-0257
• CISA Known Exploited Vulnerabilities catalog

Last checked October 29, 2026 against the advisory (last updated June 3), Unit 42 (updated through October 26), Rapid7 and the CISA catalog (version 2026.10.28).