CVE-2026-0257

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-0257 9.1

Palo Alto Networks · PAN-OS · Added 2026-05-29 · Published 2026-05-13

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityPalo Alto Networks PAN-OS Authentication Bypass Vulnerability

VendorPalo Alto Networks

ProductPAN-OS

Date added2026-05-29

Due date2026-06-01

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-565

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Descriptions

KEV: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

NVD: Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 04:41 UTC

Wall time1.2s

Searches5

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-0257
https://security.paloaltonetworks.com/CVE-2026-0257
https://github.com/sfewer-r7/CVE-2026-0257
https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/
https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/
https://nefariousplan.com/posts/pan-os-cve-2026-0257-cookie-cert-was-the-tls-cert
https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-0257/
https://www.sentinelone.com/vulnerability-database/cve-2026-0257/
https://threatprotect.qualys.com/2026/06/01/cisa-warns-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

Hunting hypothesis agent

Hunt for GlobalProtect login requests with forged Base64 auth-override cookies encrypted via the TLS public key, containing spoofed username/host_id values - correlate vpn-auth-override logs with certificate enumeration on port 443.

Research details

ComponentGlobalProtect portal and gateway authentication module

PreconditionsThe firewall must have GlobalProtect portal or gateway configured and exposed on the network (typically on TCP port 443). Authentication override cookies must be enabled in the GlobalProtect portal or gateway configuration (Generate cookie for authentication override or Accept cookie for authentication override options checked). The certificate used to encrypt and decrypt authentication override cookies must be the same certificate used for the portal or gateway's HTTPS service (or otherwise exposed via a publicly accessible service), allowing a remote attacker to obtain the corresponding public key from the TLS handshake. The attacker must have network reachability to the GlobalProtect interface. No prior authentication is required. The attacker connects to the HTTPS service, retrieves the server's certificate chain, forges an RSA-PKCS1v15-encrypted authentication override cookie containing arbitrary user identity data (username, domain, client_os, host_id, timestamp, client_ip), and presents it to the GlobalProtect gateway or portal. The vulnerable PAN-OS version decrypts the cookie using its private key and trusts the decrypted contents without performing any digital signature or integrity validation, granting the attacker an authenticated VPN session. agent

Deliverynetwork-based exploitation of exposed GlobalProtect interface

Public PoCyes

PoC URLs https://github.com/sfewer-r7/CVE-2026-0257 Third-party repos; verify before use.

Advisoryhttps://security.paloaltonetworks.com/CVE-2026-0257

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). Exploitation requires a specific non-default configuration (auth override cookies enabled + certificate reuse). Rapid7 published a working PoC on 2026-05-29. Active exploitation observed in the wild since May 17, 2026.

SummaryPalo Alto Networks PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) | Public PoC published by Rapid7 on GitHub | Active exploitation confirmed by Unit 42 and Rapid7 | Added to CISA KEV on 2026-05-29 | Vendor advisory: security.paloaltonetworks.com | Authentication override cookie feature not enabled by default

Tia coverage

First reported2026-05-30

First exploit report2026-05-30

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chocopoc-malware-targets-security-researchers-via-trojanized-poc pan-os-cve-2026-0257-cisa-kev-globalprotect-authentication-bypas

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.