# Palo Alto Networks PAN-OS / Prisma Access GlobalProtect Authentication Bypass (CVE-2026-0257) — Active Exploitation, CISA KEV

> CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS and Prisma Access. When Cloud Authentication Service (CAS) is disabled and authentication-override cookies are enabled with a reused certificate, a remote, unauthenticated attacker can forge or replay an auth-override cookie and establish an unauthorized VPN connection. CISA added it to the KEV catalog on 2026-05-29 (remediation due 2026-06-01) after Rapid7 MDR observed in-the-wild exploitation across multiple customers in two waves beginning 2026-05-17.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-10-20T17:50:26.483Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0631
- **ID:** TL-2026-0631
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 65 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0257, CVE-2023-27532

## Description

CVE-2026-0257 is an authentication bypass affecting the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS software and Prisma Access. Panorama and Cloud NGFW are not impacted. Palo Alto Networks published the advisory on 2026-05-13 and classifies the flaw as CWE-565 (Reliance on Cookies without Validation and Integrity Checking), assigning a CVSS v4.0 base score of 7.8 (HIGH). No CVSS v3.1 metrics were issued. Although the numeric score is HIGH rather than CRITICAL, CISA's KEV addition and Rapid7 both urge organizations to treat the issue as critical because it is an unauthenticated authentication bypass on an internet-facing enterprise VPN appliance under active exploitation.

Exploitation requires a specific, but not uncommon, configuration: the GlobalProtect portal or gateway must have Cloud Authentication Service (CAS) disabled, authentication-override cookies enabled (cookie generation and acceptance), and the authentication-override encryption certificate reused/shared with the HTTPS service certificate. Under these conditions the integrity of the authentication-override (auth) cookie is not properly validated, allowing a remote unauthenticated attacker to forge or replay a valid session cookie, bypass GlobalProtect authentication, and bring up a VPN tunnel through the gateway. In a subset of wave-2 victims this resulted in the attacker being assigned an internal VPN IP address.

Rapid7 MDR observed in-the-wild exploitation across multiple customer environments. The earliest activity was observed on 2026-05-17; the first MDR alert fired on 2026-05-18 at 01:51:37 UTC under the rule "Suspicious VPN Authentication - Local Account Logon via Generic Non-Human Identity." Attackers performed suspicious cookie authentication to the local admin account. Wave 1 originated from the hosting provider Vultr (source IP 104.207.144.154) and presented the Linux client hostname GP-CLIENT. A second wave on 2026-05-21 originated from the hosting provider Dromatics Systems (source IPs 146.19.216.125, 146.19.216.119, 146.19.216.120 within 146.19.216.0/24) and presented the Windows client hostname DESKTOP-GP01. A consistent spoofed MAC address (aa:bb:cc:dd:ee:ff) was observed across both waves, suggesting a single threat actor reusing tooling. Rapid7 did not observe successful lateral movement from the compromised devices in most cases.

BeaconBeagle lookups performed during research (2026-05-29) returned no known C2 beacon match for any of the four source IPs, consistent with these being attacker-controlled hosting/VPS exploitation sources rather than persistent command-and-control infrastructure.

Remediation: apply the fixed PAN-OS / Prisma Access versions, or, where patching is not immediately possible, apply the official workarounds — disable the Authentication Override options (generate and accept cookies) in the GlobalProtect portal and gateway configuration, and/or use a dedicated certificate exclusively for authentication-override cookies. Re-enabling Cloud Authentication Service also removes the vulnerable condition. CISA BOD 22-01 requires federal agencies to remediate by 2026-06-01.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1539 Steal Web Session Cookie
- T1550 Use Alternate Authentication Material
- T1556 Modify Authentication Process
- T1036 Masquerading
- T1078 Valid Accounts
- T1572 Protocol Tunneling
- T1003 OS Credential Dumping
- T1606 Forge Web Credentials
- T1021 Remote Services
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1016 System Network Configuration Discovery
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1219 Remote Access Tools
- T1074 Data Staged
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1570 Lateral Tool Transfer
- T1562.001 Impair Defenses
- T1003.001 OS Credential Dumping
- T1003.003 OS Credential Dumping
- T1021.001 Remote Services
- T1021.002 Remote Services
- T1550.004 Use Alternate Authentication Material
- T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
- T1087.002 Account Discovery: Domain Account
- T1069.002 Permission Groups Discovery: Domain Groups
- T1018 Remote System Discovery
- T1569.002 System Services: Service Execution
- T1070.001 Indicator Removal: Clear Windows Event Logs

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-0257)](https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-0257 entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Palo Alto Networks Security Advisory — CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass](https://security.paloaltonetworks.com/CVE-2026-0257)
- [NVD — CVE-2026-0257](https://nvd.nist.gov/vuln/detail/CVE-2026-0257)
- [Rapid7 — Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)](https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257)
- [Tenable — CVE-2026-0257](https://www.tenable.com/cve/CVE-2026-0257)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0631