Palo Alto PAN-OS: Authentication bypass in GlobalProtect

Summary

A flaw in the GlobalProtect portal and gateway of PAN-OS allows an attacker to bypass authentication and establish an unauthorized VPN connection. The issue is caused by reliance on cookies without validation and integrity checking (CWE-565) in the authentication override feature. Exploitation requires that authentication override cookies are enabled and that a specific certificate configuration exists. Panorama and Cloud NGFW are not affected, and Palo Alto reports limited exploitation attempts; CISA lists the flaw in the KEV catalog as used in ransomware campaigns.

Affected

• PAN-OS 12.1.0 to below 12.1.7 (except 12.1.4-h6 and later)
• PAN-OS 11.2.0 to below 11.2.12 (fixed builds per vendor table, e.g. 11.2.10-h7, 11.2.7-h14, 11.2.4-h17)
• PAN-OS 11.1.0 to below 11.1.15 (fixed builds per vendor table, e.g. 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33)
• PAN-OS 10.2.0 to below 10.2.18-h6 (fixed builds per vendor table, e.g. 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34)
• Prisma Access 10.2 and 11.2 (before 10.2.10-h36 and 11.2.7-h13, upgraded by the vendor)
• Not affected: Cloud NGFW, Panorama
• Older unsupported PAN-OS releases: unknown fixed version, upgrade to a supported release required

Fixed in

• PAN-OS 12.1.7 or later, or 12.1.4-h6
• PAN-OS 11.2.12 or later, or 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
• PAN-OS 11.1.15 or later, or 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
• PAN-OS 10.2.18-h6 or later, or 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
• Prisma Access: upgraded by the vendor on its own schedule
• Note: GlobalProtect users must re-authenticate once after the upgrade, even if a valid cookie exists.

Workaround

• Use a dedicated certificate exclusively for authentication override cookies; do not reuse the portal or gateway certificate.
• Disable the Authentication Override options (generate and accept cookies) in the GlobalProtect portal and gateway configuration.
• Workarounds do not replace patching.

Exploitation

• Actively exploited: Palo Alto reports limited exploit attempts against unpatched devices without mitigations.
• Added to the CISA KEV catalog on 2026-05-29; reported use in ransomware campaigns.
• CISA SSVC: exploitation active, automatable no, technical impact total.

Our recommendation

• Check whether GlobalProtect portals or gateways use authentication override cookies, following the vendor steps.
• Patch internet-facing GlobalProtect systems to a fixed version as a priority.
• If patching is not possible immediately, apply the workarounds and verify the certificate configuration.
• Review VPN logs for unexpected sessions and cookie-based logins, and check exposure of devices from Cloud NGFW or Panorama separately (not affected).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (7 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  sfewer-r7/CVE-2026-0257 · akashsingh0454/CVE-2026-0257-PoC · HORKimhab/CVE-2026-0257 · 0xBlackash/CVE-2026-0257 · tushargurav28/CVE-2026-0257

Research sources

• Palo Alto Networks Security Advisory CVE-2026-0257 security.paloaltonetworks.com
• Siemens SSA-967325 cert-portal.siemens.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• Rapid7 observed exploitation of PAN-OS GlobalProtect authentication bypass www.rapid7.com
• Horizon3.ai CVE-2026-0257 analysis horizon3.ai
• CCB Belgium advisory on actively exploited PAN-OS vulnerability ccb.belgium.be
• Triskele Labs CVE-2026-0257 analysis www.triskelelabs.com
• The Hacker News: PAN-OS GlobalProtect authentication bypass thehackernews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:00.