Summary
Palo Alto Networks has upgraded the severity of CVE-2026-0257 from medium to high (CVSS 7.8) after widespread exploitation of the authentication bypass vulnerability in PAN-OS GlobalProtect was confirmed across multiple customer environments. The flaw allows remote, unauthenticated attackers to forge authentication override cookies and establish unauthorized VPN connections to corporate networks.
The vulnerability exists because GlobalProtect’s authentication override cookies lack sufficient validation. When the certificate used for these cookies is reused by the portal or gateway’s HTTPS service — a common configuration — an attacker can extract the public key and forge valid cookies to bypass authentication entirely. Rapid7 has confirmed observing successful exploitation via forged cookie authentication probes across multiple customers since mid-May 2026.
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of June 1, 2026. Affected versions include PAN-OS 10.2, 11.1, 11.2, and 12.1, as well as Prisma Access. Palo Alto recommends generating a dedicated certificate for authentication override cookies as the primary mitigation, or disabling the cookie-based authentication override feature entirely.
Sources
- Help Net Security — Hackers Exploiting PAN-OS GlobalProtect VPN Auth Bypass
- Rapid7 — Observed Exploitation of PAN-OS GlobalProtect Auth Bypass
- Palo Alto Networks Security Advisory
Commentary
This is a textbook example of why certificate reuse across different functions is a terrible practice. A configuration choice that probably seemed harmless — using the same cert for HTTPS and auth cookies — turns into a complete authentication bypass because attackers can trivially obtain the public key. The fact that Palo Alto initially rated this as medium severity while it was already being exploited in the wild raises questions about their initial triage process.
GlobalProtect is one of the most widely deployed enterprise VPN solutions. An authentication bypass that lets anyone with the public key forge a valid VPN session is essentially an open door into corporate networks. If you’re running GlobalProtect with authentication override cookies enabled, check your certificate configuration immediately. Better yet, generate a dedicated certificate that isn’t exposed through any public-facing service. This is a one-line config change that closes a critical attack vector.