Listen to this Post
Introduction
A critical authentication bypass vulnerability, CVE-2026-0257, has been identified in Palo Alto Networks PAN-OS and Prisma Access, allowing unauthenticated attackers to forge session cookies and gain unauthorized VPN access. This flaw is triggered when the “authentication override” feature is enabled and the certificate used for encrypting these cookies is shared with another service, such as the HTTPS portal—a configuration that effectively breaks the security model of one of the most widely deployed enterprise VPN solutions.
Learning Objectives
- Understand the technical root cause of CVE-2026-0257 and why certificate sharing is dangerous.
- Learn how to detect exploitation using Indicators of Compromise (IoCs) and log analysis.
- Master step-by-step patching, mitigation, and remote verification commands for Linux and Windows environments.
You Should Know
- The Vulnerability Deep Dive: Why Certificate Sharing Breaks GlobalProtect
The “authentication override” feature in GlobalProtect portals and gateways issues session cookies to authenticated users, functioning like a bearer token to avoid re-authentication. Under normal circumstances, this cookie is encrypted with a dedicated certificate. However, the vulnerability arises when this same certificate is also used for the HTTPS service of the portal or gateway. Because the decryption process in the `/usr/local/bin/gpsvc` binary performs no signature verification after decrypting the cookie, any attacker who can retrieve the public key from the exposed HTTPS certificate can forge a valid authentication cookie and bypass authentication entirely. This results in a complete bypass of the VPN’s security controls, granting the attacker the same network privileges as a legitimate remote user.
Step-by-step guide explaining what this does and how to use it.
To understand the exploitation chain, you can examine the publicly available Proof-of-Concept (PoC) scripts for research and defensive testing purposes only. These scripts demonstrate how an attacker iterates over the certificate chain to forge a cookie.
Linux / macOS (Python 3.8+):
Clone the Rapid7 PoC repository git clone https://github.com/sfewer-r7/CVE-2026-0257.git cd CVE-2026-0257 Install dependencies (if any) pip install -r requirements.txt Forge a cookie for a target GlobalProtect portal python forge_cookie.py --target 192.168.86.99 --user admin To see the forged cookie and response details, use the verbose flag python forge_cookie.py --target vpn.example.com --port 443 --verbose
This script retrieves the certificate chain, attempts to forge a cookie using each public key, and logs whether the forged cookie is accepted by the gateway or portal.
Detection & Verification (No Exploitation):
For passive, read-only detection to check if your system is vulnerable without exploitation, use the following script:
Clone the detection-only repository git clone https://github.com/akashsingh0454/CVE-2026-0257-PoC.git cd CVE-2026-0257-PoC Run the detection script against a single target python3 cve_2026_0257_check.py vpn.example.com Check multiple targets python3 cve_2026_0257_check.py host1.example.com host2.example.com Output results in JSON format for SIEM integration python3 cve_2026_0257_check.py vpn.example.com --json
This script performs version fingerprinting and checks for behavioral indicators that cookie-based authentication override may be enabled, without forging cookies or submitting credentials.
Windows (PowerShell):
While Python is the primary method, you can use PowerShell to check the certificate chain of your GlobalProtect portal:
Retrieve and examine the SSL certificate chain from the portal
$URL = "https://vpn.example.com"
$WebRequest = [Net.WebRequest]::Create($URL)
try { $WebRequest.GetResponse() } catch {}
$ServicePoint = [Net.ServicePointManager]::FindServicePoint($URL)
$Certificate = $ServicePoint.Certificate
$Certificate | Format-List
For a more detailed chain inspection, use the .NET class
$X509Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($Certificate)
Write-Host "Subject: $($X509Cert.Subject)"
Write-Host "Issuer: $($X509Cert.Issuer)"
Write-Host "Serial Number: $($X509Cert.SerialNumber)"
Write-Host "Thumbprint: $($X509Cert.Thumbprint)"
- Exploitation in the Wild: IoCs, Log Analysis, and Immediate Response
Active exploitation began just four days after the advisory was published, with attacks originating from hosting providers and demonstrating a sophisticated, organized threat actor. Two distinct waves of attacks have been observed.
Step-by-step guide explaining what this does and how to use it.
Identified Indicators of Compromise (IoCs):
| Indicator | Type | Wave |
| : | : | : |
| `104.207.144.154` | Threat actor source IP | Wave 1 (May 17) |
| `146.19.216.119` / `.120` / `.125` | Threat actor source IPs | Wave 2 (May 21) |
| `aa:bb:cc:dd:ee:ff` | Spoofed MAC address | Both waves |
| `GP-CLIENT` | Machine name (Linux auth) | May 17 |
| `DESKTOP-GP01` | Machine name (Windows auth) | May 21 |
The consistent use of the spoofed MAC address strongly suggests a single threat actor is behind both campaigns.
How to Hunt for Compromise in Your Logs (Linux & Windows):
Linux (Syslog/RSyslog):
To search for suspicious authentication events in your syslog, use `grep` to filter for the IoCs and abnormal cookie logins:
Search for the malicious source IPs sudo grep -E "104.207.144.154|146.19.216.119" /var/log/syslog Look for the spoofed MAC address in DHCP or VPN logs sudo grep "aa:bb:cc:dd:ee:ff" /var/log/daemon.log Search GlobalProtect logs for cookie-based authentication (non-human identity) sudo grep "GLOBALPROTECT.Cookie" /var/log/messages | grep -v "success"
Windows (PowerShell):
For Windows-based GlobalProtect gateways or log aggregation, use PowerShell to parse logs:
Query the Security Event Log for suspicious logins from anomalous source IPs
$maliciousIPs = @("104.207.144.154", "146.19.216.119")
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | ForEach-Object {
$_.Properties[bash].Value -match ($maliciousIPs -join "|")
}
Search for the spoofed client name in VPN logs (adjust log path as needed)
Get-ChildItem -Path "C:\ProgramData\Palo Alto Networks\Logs\" -Recurse | Select-String -Pattern "GP-CLIENT", "DESKTOP-GP01"
Rapid7’s Observed Exploitation Log Entry Example:
A typical suspicious log entry from a compromised system will show a `Cookie` based authentication for a local admin account, originating from a non-corporate IP address, as seen below:
<14>May 18 01:51:37 palovpn-01 1,2026/05/18 01:51:37,...GLOBALPROTECT...login,Cookie,,admin,US,GP-CLIENT,104.207.144.154,...aa:bb:cc:dd:ee:ff,...success...
This log shows a successful login via `Cookie` for the `admin` user from the malicious IP 104.207.144.154, using the spoofed client name `GP-CLIENT` and the spoofed MAC address aa:bb:cc:dd:ee:ff.
3. Patching, Mitigation, and Long-Term Hardening
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate by June 1, 2026. All organizations are strongly urged to treat this as a critical vulnerability and patch immediately.
Step-by-step guide explaining what this does and how to use it.
Step 1: Identify Your PAN-OS Version (Linux/Windows via CLI or API)
Before patching, verify which version you are running.
- Via SSH (Linux/macOS): `ssh admin@
` > show system info | match version
- Via API (Linux/macOS/Windows WSL):
curl -k "https://<firewall-ip>/api/?type=op&cmd=<show><system><info></info></system></show>&key=<YOUR_API_KEY>"
Step 2: Upgrade to the Patched Versions
Apply the fixed versions as listed by Palo Alto Networks. Key fixed versions include:
| Platform | Affected Versions | Fixed Version |
| : | : | : |
| PAN-OS 10.2 | < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, `< 10.2.18-h6` | `10.2.18-h6` or later |
| PAN-OS 11.1 | < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, `< 11.1.15` | `11.1.15` or later |
| PAN-OS 11.2 | < 11.2.4-h17, < 11.2.7-h14, < 11.2.10-h7, `< 11.2.12` | `11.2.12` or later |
| PAN-OS 12.1 | < 12.1.4-h6, `< 12.1.7` | `12.1.7` or later |
| Prisma Access 10.2.0 | Any | `10.2.10-h36` or later |
| Prisma Access 11.2.0 | Any | `11.2.7-h13` or later |
Step 3: Immediate Mitigation While Patching (Configuration Change)
If you cannot patch immediately, disable the vulnerable configuration. This is the most effective short-term mitigation.
1. Navigate to your GlobalProtect portal or gateway configuration.
2. Go to the Authentication Override tab.
- Uncheck the option to “Accept cookie for authentication override.”
4. Commit the changes.
Note: Panorama and Cloud NGFW are not impacted by this vulnerability.
What Undercode Say:
- Key Takeaway 1: CVE-2026-0257 is a critical authentication bypass that allows unauthenticated attackers to forge valid session cookies, gaining full VPN access without any credentials. The root cause is the failure to validate the source of the certificate used to encrypt the authentication override cookies.
- Key Takeaway 2: Active exploitation began just four days after disclosure, with two observed waves originating from Vultr and Dromatics Systems. Defenders must hunt for IoCs like `aa:bb:cc:dd:ee:ff` and `GP-CLIENT` in their logs and prioritize patching to the fixed versions (e.g., PAN-OS 12.1.7, 11.2.12) immediately.
Analysis: This incident perfectly illustrates the dangers of feature interactions and configuration complexity. A convenience feature (“authentication override”) combined with a common certificate reuse practice created a devastating security hole. The rapid exploitation timeline—just four days—highlights the efficiency of modern threat actors in weaponizing disclosed vulnerabilities. The use of consistent spoofed identifiers across both attack waves suggests a coordinated, resourceful adversary, not just opportunistic scanning. Organizations must move beyond simple patch management and embrace continuous configuration auditing and the principle of least privilege for cryptographic materials. The fact that 8 out of 10 impacted customers saw only authentication probes, not full VPN sessions, is a small relief but should not diminish the urgency; it indicates the attackers were actively probing for vulnerable targets at scale.
Expected Output:
The article is presented as above.
Prediction:
- -1 Increased Scrutiny on VPN Appliances: This vulnerability will lead to a surge in attacks against other enterprise VPN solutions (e.g., Fortinet, Cisco) as attackers pivot their techniques. Organizations will be forced to implement more aggressive patching cycles, potentially moving to weekly or even daily vulnerability scanning for edge devices.
- -1 Long-Term Shift to Cloud-Delivered SASE: The inherent complexity of on-premises VPN configurations like this will accelerate the migration toward cloud-delivered Security Access Service Edge (SASE) solutions, where authentication and certificate management are abstracted away from the customer and handled by the provider. This shift will reduce the attack surface for individual enterprises but centralize risk for the providers.
- +1 Rise of Automated Configuration Auditing Tools: In response to this, expect a new wave of security tools focused on detecting dangerous configuration patterns, such as certificate reuse across services, within network appliances. These tools will integrate directly into CI/CD and infrastructure-as-code pipelines to prevent such issues before deployment.
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Cybersecuritynews Vulnerability – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
