VulnSocial
← Back to blog

CVE-2026-0257 – Critical GlobalProtect VPN Authentication Bypass

Key Takeaways

  • CVE-2026-0257 is a Critical authentication bypass in Palo Alto Networks PAN-OS and Prisma Access GlobalProtect.
  • Actively exploited in the wild since mid‑May 2026; attackers can obtain VPN access without credentials.
  • Affects PAN‑OS 10.2.x, 11.1.x, 11.2.x, 12.1.x (and matching Prisma Access versions). Panorama and Cloud NGFW are not impacted.
  • Immediate patch or upgrade, disable the authentication‑override feature, and monitor VPN logs.

Overview

CVE-2026-0257 is an authentication bypass flaw in the GlobalProtect portal and gateway of Palo Alto Networks PAN‑OS and Prisma Access. The vulnerability stems from the “authentication override” mechanism, which issues a bearer‑like cookie to authenticated users. When the certificate used to encrypt these cookies is shared with another service (e.g., the HTTPS listener), an attacker can forge a valid cookie and gain VPN access without any credentials. This vulnerability is listed in the CISA KEV catalog, indicating confirmed active exploitation.

Technical Details

  • Feature involved: Authentication Override – creates session cookies that bypass re‑authentication.
  • Root cause: The same X.509 certificate is used for both the authentication‑override cookie encryption and the portal/gateway HTTPS service. This overlap allows an attacker to craft a valid cookie if they can obtain the certificate or exploit a related flaw.
  • Exploit mechanics: By replaying or forging a cookie, the attacker can establish a VPN tunnel as an authenticated user, effectively bypassing the login step.
  • CWE: CWE-565 (Improper Access Control).
  • CVSS v3.1: CVSS 3.1 9.1 (Critical) – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Severity & Impact

The Critical CVSS score reflects:

  • Network‑reachable attack vector (no authentication required).
  • High confidentiality and integrity impact – successful exploitation grants full internal network access via the VPN.
  • No direct availability impact, but the breach can be a stepping stone for further attacks.

Affected Products

  • Vendor: Palo Alto Networks
  • Products: PAN‑OS (including GlobalProtect portal/gateway) and Prisma Access.
  • Impacted versions: 10.2.x, 11.1.x, 11.2.x, 12.1.x (all sub‑releases). Panorama and Cloud NGFW are not affected.
  • Full list of affected versions can be reviewed on the live vulnerability page: https://vulnsocial.com/cve/CVE-2026-0257.

Actionable Insights

  1. Identify exposure: Verify whether any GlobalProtect portals or gateways are reachable from the Internet.
  2. Version check: Use the CLI (show system info) or the web UI to confirm the PAN‑OS/Prisma Access version.
  3. Feature audit: Determine if authentication override is enabled. If it is not required for your workflow, disable it immediately.
  4. Certificate hygiene: Ensure the certificate used for authentication override is not shared with other services. Rotate it if necessary.
  5. Log monitoring: Enable detailed logging for GlobalProtect authentication events. Alert on:
    • New VPN sessions from previously unseen source IPs.
    • Session creation without a corresponding successful login event.
  6. Network segmentation: Limit the reach of VPN‑connected hosts to only those resources that truly need remote access.

Remediation & Mitigation

  1. Patch – Apply the security updates released by Palo Alto Networks for all affected PAN‑OS and Prisma Access releases (see vendor advisory for exact version numbers).
  2. Upgrade – If you are on a version prior to the fixed releases, upgrade to the latest stable branch (e.g., 12.1.6 or later).
  3. Disable authentication override if it is not essential to your environment.
  4. Rotate certificates used for GlobalProtect and ensure they are unique to the VPN service.
  5. Implement detection: Deploy IDS/IPS signatures that look for forged GlobalProtect cookies (signatures are available from major vendors).
  6. Review firewall policies: Tighten rules that allow VPN‑originated traffic to sensitive internal segments.

For real‑time threat intelligence, exploit activity trends, and detailed signal data, see the live CVE page: https://vulnsocial.com/cve/CVE-2026-0257.

References

Bottom Line

CVE-2026-0257 is a Critical authentication bypass actively exploited in the wild. Immediate patch or upgrade, disable the vulnerable feature, and tighten monitoring are essential to protect your network.

#CVE20260257 #Critical #PaloAlto #GlobalProtect #CISAKEV #AuthenticationBypass