Palo Alto GlobalProtect Authentication Bypass Exploited for Unauthorized VPN Access

Attackers are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access GlobalProtect deployments to bypass authentication and gain unauthorized VPN access. The flaw affects environments where the non-default authentication override feature is enabled and the cookie encryption certificate is improperly reused with another service such as HTTPS, allowing a remote unauthenticated attacker to forge authentication override cookies. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, while Rapid7 reported exploitation beginning as early as May 17 and observed additional activity on May 21.

Rapid7 said some intrusions resulted in full VPN IP assignments and direct access to internal networks, with two of ten impacted MDR customer environments showing successful attacker VPN sessions. Investigators linked multiple waves of activity to the same threat actor based on recurring artifacts including spoofed MAC address aa:bb:cc:dd:ee:ff and hostnames such as GP-CLIENT and DESKTOP-GP01, with attack infrastructure hosted at Vultr and later Dromatics Systems. Palo Alto Networks has released patches, and defenders are being urged to upgrade immediately, disable authentication override if it is not required, use a dedicated certificate exclusively for authentication override cookies, and hunt for the published indicators of compromise.