Attackers are actively exploiting a vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN that can allow authentication bypass and unauthorized VPN access without valid user credentials.
The flaw, tracked as CVE-2026-0257, affects GlobalProtect portal and gateway configurations in PAN-OS. Palo Alto Networks disclosed and patched the issue in May, but later updated its advisory to confirm limited exploit attempts against unpatched devices without mitigations.
The vulnerability has also been added to CISA’s Known Exploited Vulnerabilities catalog, meaning affected organizations should treat remediation as urgent.
Why This Vulnerability Matters
GlobalProtect is commonly used to provide remote access to enterprise networks. That makes it a high-value target.
A vulnerability that allows attackers to bypass authentication on an edge-facing VPN appliance is especially serious because VPN access can become the first step toward broader compromise.
Once an attacker gains VPN access, they may be able to:
- access internal systems
- impersonate legitimate users
- perform reconnaissance
- test internal services
- attempt lateral movement
- target Active Directory
- access sensitive applications
- stage further attacks
- prepare ransomware or data theft operations
Even if the vulnerability is technically scored below “critical” by CVSS, the operational impact can be much higher. Unauthorized VPN access into a corporate network should be treated as a major security event.
Active Exploitation Observed
Rapid7 reported successful exploitation across multiple customer environments as early as May 17.
In many observed cases, attackers used forged authentication cookies to impersonate legitimate users and authenticate to GlobalProtect gateways.
A second wave of activity was observed on May 21, with evidence that some attackers were assigned VPN addresses and gained internal network access.
Rapid7 said it had not observed successful lateral movement from affected devices at the time of its reporting, but the fact that attackers were able to obtain VPN sessions is enough to require immediate response.
How the Vulnerability Works
The issue involves a GlobalProtect feature called authentication override.
This feature allows a GlobalProtect portal or gateway to issue an authentication override cookie to a user who has already authenticated. The user can then present that cookie later instead of re-entering credentials.
In practice, the cookie works similarly to a bearer token. If the gateway accepts it, the user is treated as authenticated.
The vulnerability depends on a specific configuration involving certificates used to encrypt and decrypt authentication override cookies.
According to Rapid7’s analysis, under certain configurations, GlobalProtect may trust decrypted cookies without properly verifying their authenticity.
If administrators reused the same certificate for both the HTTPS service and authentication override cookie encryption, attackers could obtain the certificate’s public key and generate forged cookies that vulnerable gateways accepted as valid.
This allowed attackers to bypass normal authentication.
Why Configuration Matters
The vulnerability does not affect every GlobalProtect deployment in the same way.
It requires:
- GlobalProtect portal or gateway configured
- authentication override cookies enabled
- a specific certificate configuration
- vulnerable PAN-OS versions
- no patch or mitigation applied
Authentication override is not enabled by default, but many organizations may use it for user convenience or session continuity.
The risk increases when certificates are reused across different functions instead of being dedicated to a single purpose.
This is a key lesson from the incident: certificate reuse can turn a configuration weakness into an exploitable authentication bypass.
Medium Score, Critical Business Risk
CVE-2026-0257 initially received a CVSS score of 7.8, which places it below the “critical” threshold.
However, several researchers have urged organizations to treat it as critical in practice.
The reason is simple: CVSS measures technical characteristics, but it does not always reflect the business impact of gaining VPN access to an internal network.
An unauthenticated attacker obtaining VPN access through a forged cookie can create a serious security incident, especially if the VPN environment has broad internal access or weak segmentation.
For defenders, the operational question is not only “What is the score?” but “What can an attacker do after exploiting it?”
In this case, the answer may be: enter the network.
Why Edge VPN Appliances Are Prime Targets
VPN appliances sit at the boundary between the internet and the internal network. That makes them attractive to attackers.
Threat actors frequently target edge devices because they often provide:
- remote access
- trusted network positioning
- authentication pathways
- privileged infrastructure exposure
- limited endpoint visibility
- high-value access to internal systems
Security flaws in VPN gateways, firewalls, and remote access appliances are commonly exploited by ransomware operators, nation-state groups, and initial access brokers.
Palo Alto Networks technology has been targeted before. Earlier PAN-OS vulnerabilities, including authentication bypass issues, have also drawn attention from attackers and CISA.
The lesson is clear: edge security products must be patched quickly because attackers actively monitor disclosures and weaponize exposed systems.
What Organizations Should Do Now
Organizations using affected PAN-OS GlobalProtect deployments should prioritize remediation.
Recommended actions include:
- apply Palo Alto Networks’ vendor-supplied patch immediately
- verify that all affected GlobalProtect portals and gateways are updated
- review whether authentication override is enabled
- disable authentication override if it is not required
- if authentication override is required, use a dedicated certificate for cookie encryption
- do not reuse the portal or gateway HTTPS certificate for authentication override cookies
- generate a new certificate exclusively for authentication override
- store the certificate securely
- ensure the certificate is not shared with other features or users
- review GlobalProtect logs for suspicious authentication events
- investigate unexpected VPN IP assignments
- check for unusual VPN sessions around May 17 and May 21
- review internal access from VPN-assigned addresses
- monitor for signs of lateral movement
If exploitation is suspected, treat the VPN session as unauthorized internal access and begin incident response.
Mitigation Options
If patching cannot be performed immediately, Palo Alto Networks recommends configuration-level mitigations.
The strongest temporary mitigation is to disable authentication override entirely by unchecking all options related to generating and accepting authentication override cookies in the GlobalProtect portal and gateway configuration.
If the authentication override must remain enabled, administrators should use a dedicated certificate only for authentication override cookie encryption and decryption.
This certificate should not be reused for:
- GlobalProtect portal HTTPS service
- GlobalProtect gateway HTTPS service
- other PAN-OS features
- user-facing services
- unrelated internal systems
Certificate separation is essential to reducing the risk of forged cookie abuse.
What to Monitor
Security teams should review VPN and firewall telemetry for signs of suspicious activity.
Important indicators include:
- unexpected GlobalProtect logins
- authentication events without expected credential flow
- new VPN sessions from unusual source IPs
- VPN sessions mapped to users who deny activity
- repeated connection attempts to GlobalProtect gateways
- unusual VPN address assignments
- internal scanning from VPN IP ranges
- access to sensitive systems after VPN login
- unusual traffic from low-privileged accounts
- authentication override cookie usage patterns
- configuration changes involving certificates or GlobalProtect settings
Organizations should correlate VPN logs with identity logs, endpoint telemetry, and network activity.
Incident Response Considerations
If an organization believes CVE-2026-0257 may have been exploited, patching alone is not enough.
Response steps should include:
- identify affected VPN sessions
- determine which internal systems were accessed
- review logs for reconnaissance or lateral movement
- reset or revoke potentially abused sessions
- review GlobalProtect configuration
- rotate relevant certificates if certificate exposure or reuse is suspected
- check for new accounts or privilege changes
- investigate unusual authentication activity
- review endpoint alerts from systems accessed over VPN
- hunt for persistence inside the network
Even if no lateral movement is immediately visible, unauthorized VPN access should be treated as a serious event.
Final Thoughts
CVE-2026-0257 is a reminder that VPN and edge security appliances remain among the most important systems to patch and monitor.
Although the vulnerability has configuration-specific requirements and received a CVSS score below critical, active exploitation changes the risk profile. An authentication bypass on an enterprise VPN gateway can give attackers direct access to internal networks.
Organizations running affected Palo Alto Networks PAN-OS GlobalProtect deployments should patch urgently, disable or harden authentication override, review certificate usage, and investigate suspicious VPN activity.
In modern attacks, the edge is often the first battlefield. A VPN session that should never have existed can be the beginning of a much larger intrusion.
