Loading vulnerability…
PAN-OS Cloud Authentication Service JWT Authentication Bypass
CVE-2026-0265 is a pre-authentication JWT signature verification vulnerability in Palo Alto Networks PAN-OS and Panorama when Cloud Authentication Service (CAS) is enabled on an authentication profile attached to a login interface. The pan_auth_verify function selects its signature verification algorithm from the attacker-controlled JWT alg header without enforcing the expected asymmetric algorithm. It accepts HMAC algorithms, including HS256, and incorrectly treats the CAS signing certificate bytes as an HMAC secret, allowing forged tokens to be accepted as legitimate CAS tokens. A network-accessible attacker can impersonate a trusted user through GlobalProtect or the management interface. Affected platforms include PA-Series and VM-Series firewalls and virtual and M-Series Panorama appliances. Cloud NGFW, Prisma Access, and cloud-managed PAN-OS builds with a .saas suffix are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses CAS authentication and permits user impersonation. Through GlobalProtect, an attacker can obtain a VPN session as a chosen user and access internal resources permitted to that identity. Through a CAS-enabled management interface, impersonation of an administrator can provide full administrative access, including firewall configuration changes, CLI access through the web terminal, disclosure of stored private keys and RADIUS shared secrets, and opportunities to pivot to Panorama. Management-interface exposure presents the highest risk; GlobalProtect exploitation can nevertheless provide unauthorized network access.
If you can’t patch tonight, do this now.
If immediate patching is not possible, detach CAS from affected authentication profiles and use an alternative authentication mechanism such as direct SAML, RADIUS, LDAP, or local authentication. Restrict management web access to trusted internal IP addresses and remove public management-interface exposure; this reduces management-plane risk but does not resolve exposure through CAS-enabled GlobalProtect interfaces. For PAN-OS 11.2 or later with a Threat Prevention subscription, enable Threat ID 510008 as an additional protective measure.
Patch, then assume compromise.
Upgrade to a fixed PAN-OS release appropriate to the installed maintenance branch. Fixed releases include: 12.1.4-h5 or 12.1.7 and later; 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, or 11.2.12 and later; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later; and 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later. Select the applicable fixed build rather than assuming that any numerically newer maintenance release contains the fix. The patch rejects HMAC verification when the supplied verification key is a PEM-encoded asymmetric key.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
60 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.