This issue affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Since October 19, Palo Alto’s Unit42 has observed ransomware groups leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session[2].
CVE
CVE-2026-0257
Affected Products
PAN-OS 12.1 prior to 12.1.4-h6 and 12.1.7
PAN-OS 11.2 prior to 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 and 11.2.12
PAN-OS 11.1 prior to 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15
PAN-OS 10.2 prior to 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6
Prisma Access 11.2 prior to 11.2.7-h13
Prisma Access 10.2 prior to 10.2.10-h36
Exploitation
The vulnerability is being actively exploited according to Unit42[2].
Threat Actor
Qilin
Inc Ransom
Recommended Actions
Truesec recommends that you upgrade to a safe version:
PAN-OS 12.1 – safe version: 12.1.4-h6, 12.1.7, or later
PAN-OS 11.2 – safe version: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12, or later
PAN-OS 11.1 – safe version: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15, or later
PAN-OS 10.2 – safe version: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6, or later
Prisma Access 11.2 – safe version: 11.2.7-h13 or later
Prisma Access 10.2 – safe version: 10.2.10-h36 or later
If Upgrading Is Not Possible, Consider to[1]:
- Check if authentication cookies are enabled.
- Generate a new certificate exclusively for authentication override cookies and store it securely. Do not reuse the portal or gateway certificate, and do not share this certificate with other features or users.
- Uncheck the Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration.
How To Check if Authentication Cookies Are Enabled [1]:
On the Portal:
- Navigate to Network > GlobalProtect > Portals in the management interface.
- Click on your Portal Name and go to the Agent tab.
- Click on your Agent Configuration profile.
- Go to the Authentication tab.
- Generate cookie for authentication override or Accept cookie for authentication override options are checked.
On the Gateway:
- Navigate to Network > GlobalProtect > Gateways in the management interface.
- Click on your Gateway Name and go to the Agent tab.
- Click on your Client Settings profile.
- Go to the Authentication Override tab.
- Accept cookie for authentication override option is checked.
Detection
Truesec is actively threat hunting for indicators connected to exploitation.
According to Unit42, For pre-proof of concept release (May 29, 2026) activities, search for these IP addresses in GlobalProtect logs to look for successful login connection[2]:
23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47
Search GlobalProtect logs for successful gateway-connected events from any IP address using suspicious host IDs or device names, including but not limited to:
aa:bb:cc:dd:ee:ff
00:11:22:33:44:55
WINDOWS-LAPTOP-001
DESKTOP-GP01
GP-CLIENT
As part of post-PoC release monitoring, search GlobalProtect logs for successful gateway-connected events matching the following hard-coded client configuration values from the PoC code.endpoint_os_version : Microsoft Windows 10 Pro 64-bit
source_user_info.domain : empty
References
[1] https://security.paloaltonetworks.com/CVE-2026-0257
[2] https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
The post CVE-2026-0257: Actively Exploited PAN-OS GlobalProtect Authentication Bypass Vulnerability appeared first on Truesec.
Article Link: CVE-2026-0257: Actively Exploited PAN-OS GlobalProtect Authentication Bypass Vulnerability - Truesec