Tia N.List

CTI · reviewed · 2026-09-25

PAN-OS CVE-2026-0257 CISA KEV — GlobalProtect Authentication Bypass Actively Exploited, Rapid7 Confirms Two Attack Waves

Full story & timeline

Actors

—

Malware / tools

—

Campaigns

—

CVEs

CVE-2026-0257

Victim sectors

government

Geography

Japan

MITRE ATT&CK

Indicators

Observables tied to this case, from the curated feed. raw sidecar

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: PAN-OS GlobalProtect Authentication Bypass Exploitation Sources
id: 70c0afc3-844f-4f48-b28e-9c1012642573
status: experimental
description: >
    Detects network connections from source IPs Rapid7 MDR observed
    exploiting CVE-2026-0257, the GlobalProtect authentication bypass
    that forges auth-override cookies: one wave from Vultr hosting
    (104.207.144.154, spoofed MAC aa:bb:cc:dd:ee:ff) and a second from
    Dromatics Systems ranges (146.19.216.119/120/125) using SAML
    authentication profiles.
references:
    - https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257
    - https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/
author: Tia N. List
date: 2026/09/25
tags:
    - attack.t1190
    - attack.t1606
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        SourceIp:
            - 104.207.144.154
            - 146.19.216.119
            - 146.19.216.120
            - 146.19.216.125
    condition: selection
falsepositives:
    - VPS or hosting ranges reused by legitimate providers after the attacker infrastructure is recycled
    - Spoofed source addresses in internal traffic
level: high

References

Source on GitHub