Palo Alto Networks Warns of GlobalProtect VPN Vulnerability Exploited in the Wild

Palo Alto Networks has warned customers about active exploitation of CVE-2026-0257, an authentication bypass vulnerability in GlobalProtect portal and gateway components of PAN-OS. The flaw can let an unauthenticated attacker establish an unauthorized VPN connection on affected and unpatched systems.

The issue is detailed in the Palo Alto Networks advisory, which rates the vulnerability as High with a CVSS-BT score of 7.8 and marks exploit maturity as attacked. The company says the bug affects specific PAN-OS and Prisma Access versions, while Panorama and Cloud NGFW are not impacted.

A separate Unit 42 threat brief says an unidentified threat actor has been probing GlobalProtect-enabled devices. Only a small share of probed devices established VPN sessions, and Palo Alto Networks says it has not confirmed lateral movement or post-access activity so far.

CVE-2026-0257 Affects Specific GlobalProtect Configurations

CVE-2026-0257 is not a blanket flaw in every Palo Alto firewall. The exposed configuration matters. The issue affects firewalls with a GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate setup exists.

In practical terms, the flaw involves cookie trust. Authentication override cookies are designed to reduce repeated authentication prompts. If the vulnerable configuration is present, an attacker may be able to abuse that trust relationship and connect through GlobalProtect without completing normal authentication.

That makes the vulnerability serious even though Palo Alto Networks rates it as High rather than Critical. GlobalProtect is remote access infrastructure, so any authentication bypass at that layer can expose internal networks to unauthorized access.

Field	Current information
CVE	CVE-2026-0257
Product area	PAN-OS GlobalProtect portal and gateway
Severity	High, CVSS-BT 7.8
Weakness type	CWE-565, reliance on cookies without validation and integrity checking
Attack vector	Network
Privileges required	None
User interaction	None
Exploitation status	Limited exploit attempts reported by Palo Alto Networks
Not affected	Panorama and Cloud NGFW

CISA Added the Palo Alto Flaw to Its KEV Catalog

CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026. The KEV entry requires U.S. federal civilian agencies to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or stop using the product if mitigations are unavailable.

The deadline listed for federal remediation is June 1, 2026. While that requirement applies to U.S. federal civilian agencies, private organizations should treat the KEV listing as a strong warning that attackers are already using the flaw in real environments.

Rapid7 also reported real-world exploitation. In its technical analysis, the company said its MDR team saw successful exploitation across multiple customers, with the earliest observed activity on May 17, 2026.

Which PAN-OS Versions Are Affected

Palo Alto Networks lists affected and fixed releases across PAN-OS 12.1, 11.2, 11.1, and 10.2, as well as certain Prisma Access versions. Customers should use the vendor advisory as the final source because fixed build numbers vary by release branch.

The issue affects deployments only when the required GlobalProtect and authentication override cookie conditions are present. However, exposed VPN infrastructure should still receive urgent review because internet-facing access systems are high-value targets.

The vendor guidance says customers can reduce risk by upgrading to a fixed PAN-OS release, disabling authentication override, or using a dedicated certificate for authentication override cookies.

Product	Affected versions	Fixed versions
PAN-OS 12.1	Earlier than 12.1.4-h6 or 12.1.7	12.1.4-h6, 12.1.7, or later fixed releases
PAN-OS 11.2	Earlier than listed fixed builds, including 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12	Relevant fixed build for the deployed branch
PAN-OS 11.1	Earlier than listed fixed builds, including 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15	Relevant fixed build for the deployed branch
PAN-OS 10.2	Earlier than listed fixed builds, including 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6	Relevant fixed build for the deployed branch
Prisma Access 11.2.0	Earlier than 11.2.7-h13	11.2.7-h13 or later fixed release
Prisma Access 10.2.0	Earlier than 10.2.10-h36	10.2.10-h36 or later fixed release

Rapid7 Saw Successful VPN Access Attempts

Rapid7 said it observed suspicious cookie authentication to local admin accounts across customer environments. In a second wave, the company saw VPN IP assignment after cookie authentication, which means the attacker received access to the internal network through the GlobalProtect gateway.

The firm said it did not observe successful lateral movement from those devices. That is an important limit, but it does not make the issue harmless. Unauthorized VPN access can become the first step toward internal reconnaissance, credential attacks, or later compromise if defenders do not respond quickly.

The Rapid7 report also notes that the original CVSSv4 score was lower, but the score was later updated to 7.8 after exploitation concerns grew. Rapid7 recommends treating the flaw as critical because it sits on an edge-facing enterprise VPN appliance.

Indicators Defenders Should Search For

Unit 42 recommends hunting for successful GlobalProtect gateway-connected events tied to the observed indicators. The most urgent searches should cover activity before the public proof-of-concept release on May 29, 2026, because pre-PoC exploitation can indicate earlier adversary access.

Security teams should review GlobalProtect authentication logs for successful connections from the IP addresses below, especially where the log shows cookie authentication, generic hostnames, suspicious MAC addresses, or unexpected local admin account usage.

Indicator type	Indicator	Context
IP address	23.128.228[.]6	Pre-PoC activity indicator
IP address	104.207.144[.]154	Pre-PoC activity indicator
IP address	146.19.216[.]119	Pre-PoC activity indicator
IP address	146.19.216[.]120	Pre-PoC activity indicator
IP address	146.19.216[.]125	Pre-PoC activity indicator
IP address	179.43.172[.]213	Pre-PoC activity indicator
IP address	185.195.232[.]139	Pre-PoC activity indicator
IP address	198.12.106[.]60	Pre-PoC activity indicator
IP address	202.144.192[.]47	Pre-PoC activity indicator

Host and Client Configuration Indicators

Hostnames and MAC addresses can also help defenders identify suspicious gateway-connected sessions. These values may appear in GlobalProtect logs and should receive closer review when paired with successful cookie authentication or unexpected VPN IP assignment.

Indicator	Type	Context
aa:bb:cc:dd:ee:ff	MAC address	Suspicious device identifier
00:11:22:33:44:55	MAC address	Suspicious device identifier
WINDOWS-LAPTOP-001	Hostname	Suspicious host ID
DESKTOP-GP01	Hostname	Suspicious host ID
GP-CLIENT	Hostname	Suspicious host ID
Microsoft Windows 10 Pro 64-bit	endpoint_os_version	Hard-coded client value reported for post-PoC monitoring
Empty domain value	source_user_info.domain	Hard-coded client configuration value reported for post-PoC monitoring

What Admins Should Do Now

Organizations should first identify every GlobalProtect portal and gateway, confirm the PAN-OS or Prisma Access version, and check whether authentication override cookies are enabled. Admins should also verify whether the authentication override cookie certificate is dedicated or reused with another feature.

If patching cannot happen immediately, disable authentication override or generate a certificate used only for authentication override cookies. These mitigations reduce exposure, but they should not replace a full upgrade to a fixed release.

The Unit 42 indicators should also be added to threat hunting workflows. Any successful gateway-connected event linked to those indicators should trigger incident response, VPN session review, and internal network monitoring.

• Inventory all GlobalProtect portals and gateways.
• Check whether the device runs an affected PAN-OS or Prisma Access version.
• Upgrade to the fixed release for the deployed branch.
• Disable authentication override if it is not required.
• Use a dedicated certificate for authentication override cookies.
• Search logs for successful cookie authentication to local admin accounts.
• Review GlobalProtect logs for the listed IPs, hostnames, MAC addresses, and hard-coded client values.
• Investigate successful gateway-connected events as potential unauthorized VPN access.

The CISA KEV listing should push this issue to the top of patching queues. VPN authentication bypass flaws give attackers a path toward internal access, and organizations should not wait for confirmed lateral movement before responding.

FAQ