Active Exploitation of PAN-OS GlobalProtect Authentication Bypass Enables Unauthorized VPN Access

Palo Alto Networks disclosed CVE-2026-0257, an authentication bypass flaw in PAN-OS GlobalProtect portal and gateway that can allow attackers to establish unauthorized VPN sessions by forging authentication override cookies. The issue occurs when PAN-OS trusts decrypted GlobalProtect cookies without validating a signature, particularly when the same certificate is used for both HTTPS and authentication override functions. Affected products include specified PAN-OS and Prisma Access versions, while Cloud NGFW and Panorama were reported as not impacted; Palo Alto Networks also published fixed releases and mitigations such as using a dedicated certificate for authentication override cookies or disabling authentication override.

Palo Alto Networks reported limited exploitation attempts against unpatched devices, and subsequent reporting said attacks were observed in the wild against multiple organizations, with activity beginning in mid-May and using infrastructure linked to Vultr and Dromatics Systems. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog, and regional defenders warned that successful compromise could give intruders direct access to corporate VPNs, creating a path for lateral movement, credential theft, and exposure of sensitive internal environments, including OT/SCADA networks. A separate Palo Alto advisory released alongside it also addressed CVE-2026-0262, a PAN-OS network traffic parsing denial-of-service issue.