--- schema: 1 kind: vulnerability title: "CVE-2026-0257: PAN-OS GlobalProtect Pre-Auth VPN Authentication Bypass" headline: "CVE-2026-0257: PAN-OS GlobalProtect Pre-Auth VPN Authentication Bypass" summary: "Background. GlobalProtect is Palo Alto Networks' SSL-VPN solution embedded in PAN-OS and widely deployed as the internet-facing VPN gateway for enterprise and government networks." discovered_at: "2026-05-30T05:00:13Z" event_date: 2026-05-29 run_id: 2026-05-30-aca445cc priority: notable immediate_action: null tags: - vulnerabilities - actively-exploited - pre-auth - auth-bypass - cisa-kev - patch-available regions: - global sectors: [] entities: [] cves: - id: CVE-2026-0257 cvss: "7.8" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available sources: - url: "https://security.paloaltonetworks.com/CVE-2026-0257" publisher: Palo Alto Networks PSIRT role: primary - url: "https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/" publisher: Rapid7 ETR role: corroborating closed_sources: [] evidence: - quote: Background. publisher: ctipilot v2 brief (migrated) verification: multi-source sourcing_note: "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)" confidence: high update_of: null references: [] deep_dive: true deep_dive_category: other org_triage: null watchlist_hit: false actions: [] migrated_from: briefs/2026-05-30.md --- **Background.** GlobalProtect is Palo Alto Networks' SSL-VPN solution embedded in PAN-OS and widely deployed as the internet-facing VPN gateway for enterprise and government networks. The authentication override feature, introduced to support certain SSO and clientless configurations, allows a GlobalProtect portal or gateway to issue signed cookies that bypass the normal MFA/SAML authentication flow on subsequent connections — trading off per-session authentication strength for session-persistence smoothness. Palo Alto's own security advisories (AA23-250A, AA24-075A) have repeatedly highlighted GlobalProtect as a target surface; this vulnerability is the most directly exploitable advisory in that series. **Vulnerability mechanics.** CVE-2026-0257 is classified CWE-565 (Reliance on Cookies Without Validation and Integrity Checking). When authentication override is enabled and the GlobalProtect portal or gateway shares an X.509 certificate with another co-hosted service — most commonly the HTTPS management or captive-portal service — that certificate's public key is retrievable by any external party simply by connecting to the HTTPS service and inspecting the TLS handshake. Palo Alto's auth-override cookie uses that same certificate to sign and encrypt session tokens. An attacker who extracts the public key can derive the encryption material needed to mint a valid authentication override cookie, then present it to the GlobalProtect service to authenticate as any user without possessing the user's credentials. The attack requires no prior foothold; the only pre-condition is network reachability to the GlobalProtect portal or gateway and the presence of a shared certificate — a configuration that has historically been documented in Palo Alto's own deployment guides as a shortcut for certificate management. **Exploitation pattern.** Rapid7 MDR observed two exploitation waves ([Rapid7 ETR, 2026-05-29](https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/)). Wave 1 (18 May): sourced from Vultr-hosted infrastructure, machine name GP-CLIENT (Linux). Wave 2 (21 May): sourced from Dromatics Systems IP space, machine name DESKTOP-GP01 (Windows). Both used a deliberately spoofed, easily-recognisable MAC address pattern — suggesting deliberate source-normalisation to defeat MAC-based network anomaly detection. Rapid7 observed successful VPN session establishment but no confirmed lateral movement in the monitored environments. A public PoC (github.com/sfewer-r7/CVE-2026-0257) was released on 29 May, the same day CISA added the CVE to KEV. The gap between the exploitation waves (18 and 21 May) and the PoC/KEV date (29 May) implies the actor possessed private pre-disclosure knowledge of the vulnerability. **MITRE ATT&CK mapping.** Initial access: T1133 (External Remote Services — GlobalProtect VPN endpoint). Credential access: T1539 (Steal Web Session Cookie, here applied to auth-override cookie forging rather than theft). Defence evasion: T1036.005 (Masquerading: Match Legitimate Name or Location — spoofed machine name DESKTOP-GP01). Lateral movement: T1021.001 (Remote Services: Remote Desktop Protocol — expected next step once inside the network segment); T1046 (Network Service Discovery — attacker-controlled GP-CLIENT enumerating accessible segments). **Affected and patched versions.** Affected: PAN-OS 10.2.x < 10.2.7-h34 (and maintenance tracks), 11.1.x < 11.1.4-h33, 11.2.x < 11.2.4-h17, 12.1.x < 12.1.4-h6. Not affected: Panorama, Cloud NGFW, Prisma SD-WAN, PA-Series managed by Panorama with no local GP config, PAN-OS < 10.2.x (EOL). Fixed: the full version matrix per PAN-OS maintenance branch is in the [vendor advisory](https://security.paloaltonetworks.com/CVE-2026-0257). Prisma Access 10.2 and 11.2: Palo Alto is rolling fixes; check Prisma Access status portal. **Detection.** GlobalProtect connection logs: look for authentication events with `auth_method: cookie` from IP addresses not previously associated with the authenticated username or the organisation's VPN-client pool. Cookie-based auth events from brand-new source IPs without a preceding web-based MFA event warrant immediate investigation. PAN-OS system logs: `globalprotectgateway-config-succ` events authenticated via cookie from non-enrolled endpoints (no prior SCEP or Panorama device-cert association). Network: VPN sessions with a deliberately spoofed MAC address pattern reused across geographically-disparate source IPs (trivially detectable from GlobalProtect connection metadata) are a strong indicator of this attack pattern; MAC-based anomaly detection in the VPN segment should alert. SIEM correlation: chain cookie-auth events to downstream firewall allow policies allowing that VPN IP to reach sensitive segments, and alert when a new-IP cookie-auth session moves east-west within minutes. **Hardening / mitigation.** Immediate: upgrade PAN-OS to the fixed versions per the vendor advisory. If patching cannot be completed within 24 hours: (a) disable authentication override cookies entirely in the GlobalProtect gateway and portal settings (`Authentication` > `No Cookie Required on Pre-Logon Connections`); this forces per-session MFA but removes the attack surface. (b) If auth-override cookies are required: generate a dedicated certificate for GlobalProtect used exclusively for that service and not shared with the HTTPS management or any other feature. This removes the public-key extraction path. Verify via `show system info` and `show sslmgr-store` that the GlobalProtect GP cert and the HTTPS service cert are distinct objects. Prisma Access organisations: apply any available Prisma Access emergency fix and validate the Prisma Access security advisory for tenant-specific remediation steps.