Attackers are actively exploiting a security vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN that can allow them to bypass authentication and gain VPN access without valid credentials.
The vulnerability, tracked as CVE-2026-0257, was disclosed and patched by Palo Alto Networks in May. The company later updated its advisory to confirm that there have been limited exploit attempts against unpatched PAN-OS devices where mitigations were not applied.
The flaw has also been added to CISA’s Known Exploited Vulnerabilities catalog, increasing the urgency for organizations to patch affected systems quickly.
Although the vulnerability received an initial CVSS score of 7.8, researchers are urging organizations to treat it as a critical operational risk. The reason is simple: an authentication bypass on an internet-facing VPN appliance can provide attackers with direct access to internal networks.
Why This Vulnerability Matters
GlobalProtect is widely used by organizations to provide remote access to internal systems. That makes it a high-value target for threat actors.
VPN gateways sit at the edge of the network. If attackers can bypass authentication, they may gain a trusted position inside the corporate environment.
From there, they may be able to:
- access internal applications
- impersonate legitimate users
- perform reconnaissance
- scan internal systems
- test access to file shares and servers
- target Active Directory
- attempt lateral movement
- access sensitive business systems
- prepare follow-on attacks such as data theft or ransomware
Even if no lateral movement has been confirmed in some observed cases, unauthorized VPN access should still be treated as a serious security incident.
Active Exploitation Confirmed
Rapid7 reported successful exploitation across multiple customer environments as early as May 17.
In many cases, attackers used forged authentication cookies to impersonate legitimate users and authenticate to GlobalProtect gateways.
A second wave of activity was observed on May 21, with evidence that some attackers were assigned VPN IP addresses and gained internal network access.
Palo Alto Networks later confirmed limited exploitation attempts against unpatched PAN-OS devices without mitigations.
The fact that exploitation has already been observed changes the risk profile. This is no longer only a theoretical vulnerability. Organizations running affected configurations should respond urgently.
How the Flaw Works
The issue is connected to a GlobalProtect feature called authentication override.
Authentication override allows a GlobalProtect portal or gateway to issue a cookie to a user after successful authentication. That cookie can then be used in future communications instead of requiring the user to re-authenticate with credentials.
In practice, this cookie behaves similarly to a bearer token. If the gateway accepts it, the user is treated as authenticated.
The vulnerability depends on a specific certificate configuration used to encrypt and decrypt these authentication override cookies.
According to Rapid7’s analysis, under certain configurations, the system may trust decrypted cookies without properly verifying their authenticity. If administrators reuse the same certificate for both the GlobalProtect HTTPS service and authentication override cookie encryption, attackers may be able to obtain the public certificate and generate forged cookies that the VPN gateway accepts as valid.
That can result in authentication bypass.
Configuration-Specific, But Still Serious
CVE-2026-0257 does not affect every GlobalProtect deployment in the same way.
The vulnerability requires specific conditions, including:
- affected PAN-OS versions
- GlobalProtect portal or gateway configured
- authentication override cookies enabled
- a vulnerable certificate configuration
- no patch or mitigation applied
Authentication override is not enabled by default, but many organizations may enable it for convenience and a smoother user experience.
The risk becomes significant when certificate reuse weakens the trust boundary around authentication cookies.
This is an important lesson: security-sensitive certificates should not be reused across different functions. A certificate used for a public HTTPS service should not also be used to protect authentication tokens.
Why the CVSS Score Can Be Misleading
The vulnerability was initially scored at 7.8, which is below the traditional “critical” threshold.
Technically, that score may reflect the specific conditions required for exploitation. However, operationally, the impact can be much more serious.
An attacker who gains unauthorized VPN access is not simply accessing one application. They may be entering the internal network.
That is why researchers have argued that organizations should treat this flaw as critical in practice.
A medium or high CVSS score does not always capture business impact. For edge-facing VPN infrastructure, even a narrowly scoped authentication bypass can create a major breach risk.
Why VPN Appliances Are Constantly Targeted
VPN appliances are attractive to attackers because they protect the doorway into the corporate network.
If attackers can compromise or bypass them, they may gain access without needing to exploit individual internal systems from the internet.
Threat actors often target VPN and edge appliances because they provide:
- remote access into trusted networks
- authentication pathways
- visibility into internal routing
- access to privileged users
- opportunities for credential theft
- a launchpad for lateral movement
- reduced endpoint visibility compared with workstations
Palo Alto Networks devices, like other major security and VPN platforms, are frequent targets because they sit directly between attackers and the enterprise environment.
Earlier PAN-OS vulnerabilities have also been exploited by threat actors, including authentication bypass issues that drew CISA attention.
What Organizations Should Do Now
Organizations using affected PAN-OS GlobalProtect deployments should act quickly.
Recommended actions include:
- apply Palo Alto Networks’ patch for CVE-2026-0257 immediately
- verify that all affected GlobalProtect portals and gateways are updated
- review whether the authentication override is enabled
- disable authentication override if it is not required
- if authentication override is required, use a dedicated certificate only for that function
- do not reuse the portal or gateway HTTPS certificate for authentication override cookies
- generate and securely store a new certificate for authentication override
- ensure the authentication override certificate is not shared with other features or users
- review VPN logs for suspicious sessions
- investigate unexpected VPN IP assignments
- review internal access from VPN-assigned addresses
- monitor for signs of scanning or lateral movement after VPN login
If suspicious VPN sessions are identified, organizations should treat them as potential unauthorized internal access.
Mitigation Options
If immediate patching is not possible, administrators should apply configuration mitigations.
The strongest temporary mitigation is to disable authentication override entirely by unchecking all options related to generating and accepting authentication override cookies in the GlobalProtect portal and gateway configuration.
If the authentication override must remain enabled, Palo Alto Networks recommends using a dedicated certificate exclusively for authentication override cookie encryption and decryption.
This certificate should not be reused for:
- GlobalProtect portal HTTPS service
- GlobalProtect gateway HTTPS service
- other PAN-OS functions
- unrelated internal services
- user-facing web services
- shared authentication features
Certificate separation helps reduce the chance that attackers can generate forged authentication cookies.
What Security Teams Should Monitor
Security teams should review both VPN activity and internal network behavior.
Useful detection areas include:
- unusual GlobalProtect authentication events
- VPN sessions from unexpected source IPs
- users receiving VPN IP addresses at unusual times
- VPN activity from users who deny logging in
- authentication override cookie usage patterns
- repeated connection attempts to portals or gateways
- internal scanning from VPN address pools
- access to sensitive systems shortly after VPN login
- unusual traffic from low-privileged accounts
- failed or suspicious attempts to access internal services
- configuration changes involving certificates or GlobalProtect settings
Logs from GlobalProtect, identity providers, endpoint detection tools, firewalls, and internal network sensors should be correlated.
Incident Response Guidance
If exploitation is suspected, patching alone is not enough.
Organizations should investigate what happened after the VPN session was established.
Recommended incident response steps include:
- identify affected VPN sessions
- determine which user identities were impersonated
- review assigned VPN IP addresses
- check what internal systems were accessed
- examine authentication logs for related activity
- hunt for internal reconnaissance
- review endpoint alerts on systems accessed over VPN
- rotate relevant certificates if reuse or exposure is suspected
- revoke suspicious sessions
- review privileged account activity
- monitor for persistence or lateral movement
Even if no lateral movement is immediately visible, unauthorized VPN access should be treated as a serious event because the attacker may have performed reconnaissance or collected information for later use.
Lessons From CVE-2026-0257
This vulnerability highlights several important security lessons.
- First, edge devices require urgent patching because attackers watch them closely.
- Second, configuration details matter. A feature that is safe under one configuration may become dangerous when certificates or trust relationships are reused incorrectly.
- Third, authentication bypass vulnerabilities on VPN infrastructure should be evaluated based on real-world impact, not only CVSS score.
Finally, organizations should assume that once attackers gain VPN access, the incident may extend beyond the appliance itself. The VPN gateway is the entry point. The real damage may happen inside the network.
The network edge remains one of the most important battlegrounds in cybersecurity. When a VPN authentication bypass is actively exploited, remediation should not wait.
