Summary
CVE-2026-0257 is a high-severity authentication bypass flaw in Palo Alto Networks PAN-OS GlobalProtect that can allow attackers to create unauthorized VPN sessions when specific authentication override settings are in use. The vulnerability is actively exploited, has been added to CISA’s KEV catalog, and requires urgent remediation.
Urgent Actions Required
- Upgrade PAN-OS and Prisma Access deployments to the vendor-provided fixed versions as soon as possible.
- Disable Authentication Override cookie generation and acceptance if it is not required.
- Use a dedicated certificate exclusively for Authentication Override cookies and ensure it is not shared with the portal, gateway, or other services.
- Verify that all GlobalProtect portals and gateways in the environment are upgraded to compatible fixed releases.
- Review GlobalProtect logs for suspicious cookie-based authentication activity and unexpected VPN connections.
Which Systems Are Vulnerable to CVE-2026-0257?
Technical Overview
- Vulnerability Type:Authentication Bypass via GlobalProtect Authentication Override Cookies
- Affected Software/Versions:
PAN-OS 12.1
- Versions earlier than 12.1.4-h6
- Versions earlier than 12.1.7
- Versions earlier than 11.2.4-h17
- Versions earlier than 11.2.7-h14
- Versions earlier than 11.2.10-h7
- Versions earlier than 11.2.12
- Versions earlier than 11.1.4-h33
- Versions earlier than 11.1.6-h32
- Versions earlier than 11.1.7-h6
- Versions earlier than 11.1.10-h25
- Versions earlier than 11.1.13-h5
- Versions earlier than 11.1.15
- Versions earlier than 10.2.7-h34
- Versions earlier than 10.2.10-h36
- Versions earlier than 10.2.13-h21
- Versions earlier than 10.2.16-h7
- Versions earlier than 10.2.18-h6
- Versions earlier than 11.2.7-h13
- Versions earlier than 10.2.10-h36
- Panorama
- Cloud NGFW
- CVSS Vector: v4.0
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Attack Requirements: None
- Vulnerable System Confidentiality Impact: Low
- Vulnerable System Integrity Impact: None
- Vulnerable System Availability Impact: None
- Subsequent System Confidentiality Impact: High
- Subsequent System Integrity Impact: High
- Subsequent System Availability Impact: None
- Patch Availability: Yes, available
How Does the CVE-2026-0257 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-0257?
Vulnerability Root Cause:
CVE-2026-0257 is caused by inadequate validation of GlobalProtect Authentication Override cookies. The affected systems decrypt the cookie and trust its contents without verifying its integrity. When the certificate used for Authentication Override cookies is reused by other services, attackers can obtain the corresponding public key and create forged cookies that are accepted as valid. This allows authentication to be bypassed and unauthorized VPN connections to be established without legitimate credentials.
How Can You Mitigate CVE-2026-0257?
If immediate patching is delayed or not possible:
- Disable Authentication Override for GlobalProtect portals and gateways.
- Create a new certificate dedicated exclusively to Authentication Override cookies.
- Do not reuse the Authentication Override certificate for HTTPS services or other functions.
- Review GlobalProtect logs for unusual cookie-based authentication activity and unexpected VPN connections.
- Restrict access to GlobalProtect portals and gateways to trusted networks where operationally feasible.
Which Assets and Systems Are at Risk?
Asset Types Affected:
- PAN-OS GlobalProtect Portal - Deployments using the GlobalProtect portal feature
- PAN-OS GlobalProtect Gateway - Deployments using the GlobalProtect gateway feature
- Prisma Access - Affected versions configured with the vulnerable feature set
- VPN Infrastructure - Systems providing remote access through GlobalProtect
Business-Critical Systems at Risk:
- Remote Access Environments - Systems relying on GlobalProtect VPN connections for user access
- Internal Corporate Networks - Unauthorized VPN sessions may provide access to internal resources
- Enterprise Security Gateways - Internet-facing GlobalProtect services exposed to external attackers
Exposure Level:
- Internet-Facing GlobalProtect Portals and Gateways - Reachable remotely without authentication
- Deployments Using Authentication Override Cookies - Required for exploitation
- Environments Reusing the Cookie Certificate for Other Services - Particularly when the same certificate is also used by the HTTPS service
- Unpatched PAN-OS and Prisma Access Systems - Palo Alto Networks confirmed active exploitation against vulnerable deployments
Will Patching CVE-2026-0257 Cause Downtime?
Patch application impact: Low. Applying the vendor-provided updates mainly requires upgrading affected PAN-OS or Prisma Access versions. Users may need to re-authenticate after the upgrade because authentication override cookies are regenerated.
Mitigation (if immediate patching is not possible): Disable authentication override cookies or use a dedicated certificate exclusively for cookie encryption. These measures reduce risk but do not replace patching.
How Can You Detect CVE-2026-0257 Exploitation?
Exploitation Signatures:
Look for successful GlobalProtect cookie-based authentication events, especially involving local administrator accounts. Suspicious logins associated with the hostnames GP-CLIENT and DESKTOP-GP01, along with the spoofed MAC address aa:bb:cc:dd:ee:ff. Successful VPN IP assignment following cookie authentication may indicate exploitation.
Indicators of Compromise (IOCs/IOAs):
- Source IPs:
- 104.207.144.154
- 146.19.216.119
- 146.19.216.120
- 146.19.216.125
- 209.99.191.137
- 79.130.26.202
- Hostnames:
- GP-CLIENT
- DESKTOP-GP01
- Jocker
- Spoofed MAC address:
- aa:bb:cc:dd:ee:ff
Behavioral Indicators:
- Successful cookie-based authentication to GlobalProtect gateways or portals
- VPN IP assignment following cookie authentication
- Access to /ssl-vpn/hipreport.esp and /ssl-vpn/getconfig.esp after successful authentication
Alerting Strategy:
- Priority: Critical
- Alert on cookie-based authentication to privileged accounts
- Alert on connections originating from the identified IOC IP addresses
- Monitor for successful VPN establishment following cookie authentication
Remediation & Response
- Incident Response Considerations:
- Review GlobalProtect logs for suspicious cookie-based authentication activity.
- Investigate connections originating from the published IOC IP addresses.
- Check for VPN sessions established through cookie authentication and review associated user accounts.
- Monitor for access to /ssl-vpn/hipreport.esp and /ssl-vpn/getconfig.esp following successful authentication events.
- After remediation, continue monitoring GlobalProtect authentication logs for suspicious activity.
See How Fidelis NDR Helps Security Teams Detect and Respond Faster
-
-
- Full-spectrum visibility across network traffic, ports, and protocols
- Integrated threat detection, DLP, sandboxing, and threat intelligence
- Automated alert correlation and threat hunting for faster investigations
-
References:
