PAN-OS GlobalProtect flaw exploited in wild
An authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) is under active exploitation and has been added to CISA's KEV catalog.
Palo Alto Networks has disclosed an authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS. The flaw allows an attacker to bypass security restrictions and establish an unauthorized VPN connection on firewalls where authentication override cookies are enabled alongside a specific certificate configuration. This impacts multiple PAN-OS 10.2, 11.1, and 11.2 branches as well as Prisma Access deployments.
Palo Alto Networks confirmed limited exploit attempts against unpatched, unmitigated devices, and CISA has added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Because GlobalProtect serves as the central control plane for VPN access, successful exploitation could allow attackers to bypass authentication, establish unauthorized remote access, and subsequently conduct reconnaissance, lateral movement, or data exfiltration within victim networks.
Organizations running affected PAN-OS or Prisma Access versions should prioritize patching immediately given confirmed in-the-wild exploitation. MS-ISAC recommends standard vulnerability management practices including timely patch deployment, network segmentation, and monitoring for anomalous VPN authentication activity as interim mitigations for systems that cannot be immediately updated.
Mentioned in this report
Detection guidance
GlobalProtect Authentication Success via Cookie-Based Override
Flags GlobalProtect portal/gateway authentication events where the auth method recorded is cookie-based override rather than full credential/SAML validation — the mechanism abused in the PAN-OS auth-bypass flaw (CVE-2026-0257). Intended as a monitoring trigger for anomalous VPN authentication, not a standalone verdict, since cookie-based reauth is also a legitimate feature. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GlobalProtect Authentication Success via Cookie-Based Override
description: Detects GlobalProtect portal or gateway login events authenticated via
auth-override cookie rather than full username/password or SAML validation. This
is the mechanism abused by CVE-2026-0257 to bypass authentication when auth-override
cookies are enabled with a specific certificate configuration. Generalises on the
auth-method/session field rather than any specific source IP, certificate, or campaign
artefact. Should be correlated with unexpected source geography/IP reputation or
logins outside normal user behaviour, as legitimate roaming clients also use cookie
reauth.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: authentication
product: paloalto
detection:
selection:
auth_method|contains: Cookie
filter_known_saml_flow:
auth_method|contains: SAML
condition: selection and not filter_known_saml_flow
falsepositives:
- Legitimate GlobalProtect clients configured with cookie-based reauthentication for
seamless roaming within the cookie's valid lifetime
- Load-balanced or clustered gateways reusing session cookies during normal failover
level: medium
id: 64dcd119-b7bc-5af1-b763-d45235bcb33e
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-pan-os-could-allow-for-authentication-bypass_2026-062
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free