Summary
Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect VPN. The flaw lets unauthenticated attackers forge authentication override cookies to establish unauthorized VPN connections, effectively bypassing security controls on GlobalProtect portal and gateway components. Exploitation has been observed since at least May 17, 2026.
Initially rated at CVSS 7.8, the vulnerability was reassessed as critical after Rapid7 reported successful exploitation across numerous customer environments. CISA added it to the KEV catalog on May 29, setting a June 1 remediation deadline for federal agencies. Unit 42, Palo Alto’s threat intelligence division, has published indicators of compromise including specific IP addresses, host IDs, and PoC-derived device configuration values.
The flaw affects firewalls with GlobalProtect portal or gateway enabled when authentication override cookies are active and a specific certificate configuration exists. Attackers exploit weaknesses in cookie validation and integrity checking. While limited post-access behavior has been observed so far, the existence of public PoC code means widespread exploitation attempts are likely only a matter of time.
Sources
- Unit 42 — Active Exploitation of PAN-OS CVE-2026-0257
- Rapid7 — Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass
- The Hacker News — Palo Alto Warns of Active Exploitation
Commentary
This is the third major VPN vendor hit with a critical auth bypass in the same month, following Check Point and Ivanti. The pattern is unmistakable: threat actors are systematically targeting perimeter VPN appliances because they offer direct network access with a single exploit. Cookie-based authentication overrides are a known weak pattern, and the fact that it took active exploitation to prompt a severity upgrade from 7.8 to critical shows the rating system consistently lags behind real-world risk.
Organizations running GlobalProtect should apply Palo Alto’s patches immediately and audit for the specific IoCs published by Unit 42. Longer term, the industry needs to accept that traditional VPN architectures are fundamentally fragile — a single auth bypass grants attackers the keys to the kingdom. Zero-trust network access models aren’t just a marketing trend; they’re an increasingly necessary architectural shift.