Palo Alto GlobalProtect flaw CVE-2026-0257 is being actively exploited to bypass authentication and establish unauthorized VPN sessions on vulnerable PAN-OS GlobalProtect portals and gateways.
Palo Alto Networks disclosed the vulnerability in May 2026 and now lists its exploit maturity as Attacked, with a CVSS v4.0 score of 7.8 and the highest suggested response urgency.
More recent threat reporting indicates that ransomware actors are using the flaw as an initial-access path, allowing them to enter corporate networks through legitimate remote-access infrastructure rather than relying on stolen VPN passwords.
Because the resulting sessions pass through an organization’s own GlobalProtect gateway, malicious access can initially resemble normal remote work.
For broader coverage of actively exploited enterprise vulnerabilities, see our CVE and Vulnerability Exploits Security Hub.
Key takeaway: CVE-2026-0257 can allow an unauthenticated attacker to establish an unauthorized GlobalProtect VPN session, but only deployments using authentication override cookies with the affected certificate configuration are exposed.
What Is CVE-2026-0257?
CVE-2026-0257 is an authentication bypass vulnerability affecting the GlobalProtect portal and gateway features in Palo Alto Networks PAN-OS.
Successful exploitation can allow an attacker without valid credentials to bypass security restrictions and establish an unauthorized VPN connection.
Palo Alto Networks classifies the vulnerability under CWE-565, which involves reliance on cookies without sufficient validation and integrity protection.
The flaw does not affect every GlobalProtect deployment.
Ransomware Actors Are Abusing GlobalProtect VPN Access
Recent reporting citing ReliaQuest says multiple threat actors, including ransomware operations associated with Qilin and Settra, have used CVE-2026-0257 to gain access through vulnerable GlobalProtect deployments.
Researchers also observed related post-access activity involving tools such as:
- Cobalt Strike
- BloodHound
- SharpHound
These tools can support reconnaissance, Active Directory discovery, credential access and lateral movement after the initial VPN connection has been established.
The threat activity reinforces why security teams should not treat a successful VPN authentication event as proof that the connecting user is legitimate.
Why Unauthorized VPN Access Is Dangerous
A compromised internet-facing service normally creates obvious exploitation telemetry.
An unauthorized VPN session can be harder to detect because the attacker enters through the same remote-access infrastructure used by legitimate employees.
Once connected, an attacker may attempt to:
- Enumerate internal systems
- Steal credentials
- Map Active Directory
- Move laterally
- Access sensitive data
- Disable security controls
- Prepare ransomware deployment
This makes VPN authentication bypass particularly valuable to ransomware affiliates and initial-access brokers.
For additional coverage of ransomware targeting enterprise infrastructure, see our Ransomware and Critical Infrastructure Defense Hub.
Palo Alto Networks Confirmed Active Exploitation
Palo Alto Networks says it has observed limited exploit attempts against unpatched PAN-OS devices where available mitigations were not applied.
Unit 42 separately confirmed active exploitation targeting GlobalProtect and reported that attackers were probing vulnerable devices for unauthorized access.
Only a portion of the systems probed during Unit 42’s observations resulted in successful gateway-connected sessions.
However, any confirmed unauthorized VPN session should be treated as a potential security incident.
CISA Added the Flaw to the KEV Catalog
CVE-2026-0257 was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on May 29, 2026.
KEV inclusion confirms that exploitation has occurred in real-world attacks rather than remaining only theoretical or proof-of-concept activity.
Which GlobalProtect Deployments Are Exposed?
The vulnerability requires a specific GlobalProtect configuration.
A firewall can be exposed when:
- A GlobalProtect portal or gateway is configured
- Authentication override cookies are enabled
- The deployment uses the vulnerable certificate configuration
Palo Alto Networks specifically advises administrators to check whether GlobalProtect portals generate or accept authentication override cookies and whether gateways accept them.
How to Check Authentication Override Configuration
For a GlobalProtect Portal, administrators can check:
Network > GlobalProtect > Portals
Agent > AuthenticationLook for:
- Generate cookie for authentication override
- Accept cookie for authentication override
For a GlobalProtect Gateway, check:
Network > GlobalProtect > Gateways
Agent > Client Settings > Authentication OverrideIf Accept cookie for authentication override is enabled, the exact PAN-OS version and certificate configuration should be reviewed against Palo Alto Networks’ advisory.
Affected PAN-OS Versions
Palo Alto Networks lists affected releases across PAN-OS 12.1, 11.2, 11.1 and 10.2.
| Branch | Examples of Fixed Releases |
|---|---|
| PAN-OS 12.1 | 12.1.4-h6 or 12.1.7 and later |
| PAN-OS 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later |
| PAN-OS 11.1 | Appropriate fixed hotfix or 11.1.15 and later |
| PAN-OS 10.2 | Appropriate fixed hotfix including 10.2.18-h6 and later |
Administrators should verify their exact maintenance release against the official Palo Alto Networks product-status table because the fixed build varies within each branch.
Prisma Access Is Also Included
The advisory also covers affected Prisma Access releases.
Palo Alto Networks lists fixed versions including:
- Prisma Access 11.2.7-h13 or later
- Prisma Access 10.2.10-h36 or later
The vendor says Prisma Access customers are being upgraded according to the rollout schedule communicated to them.
Panorama and Cloud NGFW Are Not Affected
Palo Alto Networks states that Panorama and Cloud NGFW are not affected by CVE-2026-0257.
The issue is specifically tied to vulnerable PAN-OS GlobalProtect portal and gateway configurations.
Authentication Override Cookies Are Central to the Flaw
Authentication override allows GlobalProtect to use cookies so users do not need to perform full authentication during every connection.
The feature can improve user experience, but the vulnerable configuration relied on those cookies without sufficient integrity validation.
An attacker able to abuse that condition could bypass normal authentication controls.
Palo Alto Recommends a Dedicated Certificate
Organizations that continue using authentication override should create a new certificate used exclusively for authentication override cookies.
Palo Alto Networks specifically warns administrators not to reuse:
- The GlobalProtect portal certificate
- The GlobalProtect gateway certificate
- A certificate currently or previously used by another feature
A dedicated certificate isolates the authentication-cookie mechanism from other services.
Disabling Authentication Override Is Another Mitigation
If authentication override is not required, Palo Alto Networks recommends disabling cookie generation and acceptance on the GlobalProtect portal and gateway.
This removes the configuration prerequisite required for exploitation.
However, patching to a fixed PAN-OS release remains the preferred long-term remediation.
Upgrade All GlobalProtect Components
Palo Alto Networks warns that organizations using authentication override cookies should update every portal and gateway that generates or accepts those cookies.
This includes:
- External portals
- Internal portals
- External gateways
- Internal gateways
- Applicable on-premises firewalls in hybrid Prisma Access deployments
Partially upgrading an environment can create authentication-cookie compatibility problems.
Users Must Reauthenticate After the Upgrade
The patched PAN-OS releases regenerate authentication override cookies using stronger protection.
As a result, GlobalProtect users may need to authenticate again once after the upgrade even when they previously held a valid authentication cookie.
After reauthentication, normal cookie validity behavior resumes.
Patching Alone May Not Remove Existing Attacker Access
This is one of the most important operational points for organizations responding to active exploitation.
If an attacker established an unauthorized VPN session before the firewall was patched, updating PAN-OS does not necessarily erase every session or credential obtained during the intrusion.
Security teams should consider terminating active GlobalProtect sessions after remediation and requiring users to authenticate again.
Investigate Existing GlobalProtect Sessions
Administrators should review GlobalProtect logs for suspicious gateway-connected events, particularly around the period before remediation.
Unit 42 recommends hunting for suspicious host IDs, MAC addresses and client configuration values associated with exploitation activity.
Examples observed in threat activity include suspicious device names such as:
WINDOWS-LAPTOP-001DESKTOP-GP01GP-CLIENT
These values should be treated as investigation leads rather than definitive proof of compromise.
PoC-Related Client Indicators Can Help Hunting
Unit 42 also documented client configuration values associated with publicly available proof-of-concept exploitation.
Security teams can search for successful gateway connections containing unusual values including:
endpoint_os_version: Microsoft Windows 10 Pro 64-bit
source_user_info.domain: emptyOrganizations should combine these indicators with authentication logs, endpoint telemetry and identity activity rather than relying on a single artifact.
Why Edge VPN Devices Remain Attractive to Ransomware Groups
VPN gateways sit directly on the enterprise perimeter and provide legitimate connectivity into internal environments.
A vulnerability that bypasses authentication can eliminate several steps normally required for initial access.
Attackers may avoid:
- Password guessing
- Credential phishing
- MFA interception
- Social engineering
If the compromised VPN session appears legitimate, attackers may gain additional time before defenders identify the intrusion.
What Security Teams Should Do Now
- Identify every internet-facing GlobalProtect portal and gateway.
- Verify the exact PAN-OS maintenance release.
- Check whether authentication override cookies are enabled.
- Review the certificate used for authentication override.
- Upgrade affected systems to a fixed version.
- Disable authentication override if it is not required.
- Use a new dedicated certificate if the feature remains enabled.
- Terminate existing GlobalProtect sessions after remediation where appropriate.
- Review VPN logs for suspicious successful connections.
- Investigate post-access activity involving credential theft or lateral movement.
Do Not Ignore Post-Exploitation Activity
Finding and patching the vulnerable firewall is only one part of incident response.
Security teams should also investigate what happened after any unauthorized VPN connection.
Useful areas to review include:
- Active Directory reconnaissance
- Unusual privileged authentication
- Credential-dumping behavior
- Remote service use
- Lateral movement
- Unusual PowerShell execution
- Cobalt Strike or similar command-and-control activity
- Data staging or exfiltration
Frequently Asked Questions
What is CVE-2026-0257?
CVE-2026-0257 is an authentication bypass vulnerability affecting specific Palo Alto Networks PAN-OS GlobalProtect portal and gateway configurations.
What can an attacker do?
An unauthenticated attacker can potentially bypass security restrictions and establish an unauthorized VPN connection.
What is the CVSS score?
Palo Alto Networks assigns CVE-2026-0257 a CVSS v4.0 score of 7.8 and a High severity rating.
Is CVE-2026-0257 actively exploited?
Yes. Palo Alto Networks lists exploit maturity as Attacked, Unit 42 has observed active exploitation and the vulnerability is included in CISA’s Known Exploited Vulnerabilities catalog.
Are ransomware groups using the vulnerability?
Recent reporting citing ReliaQuest says ransomware actors including Qilin and Settra have used the flaw to establish unauthorized GlobalProtect VPN sessions.
Is every GlobalProtect deployment vulnerable?
No. Exposure requires authentication override cookies to be enabled together with the affected certificate configuration on vulnerable PAN-OS releases.
Are Panorama and Cloud NGFW affected?
No. Palo Alto Networks says Panorama and Cloud NGFW are not affected by CVE-2026-0257.
Is patching enough after exploitation?
Not necessarily. Organizations should also investigate active VPN sessions and post-exploitation activity because attackers may have established access before the firewall was updated.
Final Takeaway
The actively exploited Palo Alto GlobalProtect flaw CVE-2026-0257 demonstrates why internet-facing VPN appliances remain high-value targets for ransomware operations.
The vulnerability can allow unauthenticated attackers to establish unauthorized VPN sessions on specific GlobalProtect configurations, potentially making malicious access appear similar to legitimate remote work.
Palo Alto Networks has released fixed versions and mitigation guidance, but organizations should go beyond patching by terminating suspicious sessions and investigating activity that occurred before remediation.
With ransomware actors increasingly targeting edge VPN infrastructure, vulnerable GlobalProtect deployments should be treated as an incident-response priority rather than a routine patching task.
Stay Updated on Critical Vulnerabilities
VPN gateways, firewalls and other internet-facing security appliances continue to be prime targets for ransomware groups and initial-access brokers.
Follow CyberUpdates365 for verified vulnerability alerts, active exploitation updates, ransomware intelligence and practical remediation guidance.
Official and Primary Sources
Palo Alto Networks Security Advisory:
CVE-2026-0257 GlobalProtect Authentication Bypass Vulnerabilities
Palo Alto Networks Unit 42:
Active Exploitation of PAN-OS CVE-2026-0257
