CVE-2026-0257: Actively Exploited PAN-OS GlobalProtect Authentication Bypass Vulnerability

This issue affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists.

Since October 19, Palo Alto’s Unit42 has observed ransomware groups leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session[2].

CVE

CVE-2026-0257

Affected Products

PAN-OS 12.1 prior to 12.1.4-h6 and 12.1.7
PAN-OS 11.2 prior to 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 and 11.2.12
PAN-OS 11.1 prior to 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15
PAN-OS 10.2 prior to 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6
Prisma Access 11.2 prior to 11.2.7-h13
Prisma Access 10.2 prior to 10.2.10-h36

Exploitation

The vulnerability is being actively exploited according to Unit42[2].

Threat Actor

Qilin
Inc Ransom

Recommended Actions

Truesec recommends that you upgrade to a safe version:
PAN-OS 12.1 – safe version: 12.1.4-h6, 12.1.7, or later
PAN-OS 11.2 – safe version: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12, or later
PAN-OS 11.1 – safe version: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, or later
PAN-OS 10.2 – safe version: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, or later
Prisma Access 11.2 – safe version: 11.2.7-h13 or later
Prisma Access 10.2 – safe version: 10.2.10-h36 or later

If Upgrading Is Not Possible, Consider to[1]:

• Check if authentication cookies are enabled.
• Generate a new certificate exclusively for authentication override cookies and store it securely. Do not reuse the portal or gateway certificate, and do not share this certificate with other features or users.
• Uncheck the Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration.

How To Check if Authentication Cookies Are Enabled [1]:

On the Portal:

1. Navigate to Network > GlobalProtect > Portals in the management interface.
2. Click on your Portal Name and go to the Agent tab.
3. Click on your Agent Configuration profile.
4. Go to the Authentication tab.
5. Generate cookie for authentication override or Accept cookie for authentication override options are checked.

On the Gateway:

1. Navigate to Network > GlobalProtect > Gateways in the management interface.
2. Click on your Gateway Name and go to the Agent tab.
3. Click on your Client Settings profile.
4. Go to the Authentication Override tab.
5. Accept cookie for authentication override option is checked.

Detection

Truesec is actively threat hunting for indicators connected to exploitation.

According to Unit42, For pre-proof of concept release (May 29, 2026) activities, search for these IP addresses in GlobalProtect logs to look for successful login connection[2]:

23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47

Search GlobalProtect logs for successful gateway-connected events from any IP address using suspicious host IDs or device names, including but not limited to:
aa:bb:cc:dd:ee:ff
00:11:22:33:44:55
WINDOWS-LAPTOP-001
DESKTOP-GP01
GP-CLIENT

As part of post-PoC release monitoring, search GlobalProtect logs for successful gateway-connected events matching the following hard-coded client configuration values from the PoC code.
endpoint_os_version : Microsoft Windows 10 Pro 64-bit
source_user_info.domain : empty

References

[1] https://security.paloaltonetworks.com/CVE-2026-0257
[2] https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/