Listen to this Post
Introduction
A critical authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN is being actively exploited in the wild, allowing unauthenticated remote attackers to forge valid session cookies and establish unauthorized VPN connections without a password. Tracked as CVE-2026-0257 with a CVSS score of 9.1, this flaw stems from inadequate validation of authentication override cookies (CWE-565) — the appliance decrypts and trusts cookie contents without verifying their integrity or origin. With confirmed exploitation attempts observed as early as May 17, 2026, and CISA adding the vulnerability to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of June 1, 2026, organizations running GlobalProtect face an urgent security imperative.
Learning Objectives
- Understand the technical root cause of CVE-2026-0257 and why cookie-based authentication fails without cryptographic integrity verification
- Learn how attackers forge authentication override cookies using publicly accessible TLS certificates to achieve unauthenticated VPN access
- Master detection techniques, log analysis, and indicator-of-compromise (IOC) hunting for post-exploitation activity
- Implement patching strategies, interim workarounds, and certificate separation to mitigate the vulnerability
- Recognize post-exploitation behaviors including Impacket-based reconnaissance, IPSec tunnel establishment, and internal SMB/NTLM activity
You Should Know
- The Core Vulnerability — Why Encryption Without Signatures Fails
The GlobalProtect authentication override feature issues encrypted cookies (portal-userauthcookie) to authenticated users so they can reconnect without re-entering credentials. Under normal operation, the server generates a cookie, encrypts it with its RSA private key, and the client stores it. On reconnect, the client sends the cookie back, and the server decrypts it using its private key.
The fatal flaw: The server only checks whether the cookie decrypts successfully. It performs no signature verification on the decrypted content and does not verify who encrypted it or whether the plaintext is legitimate. Since the RSA public key is embedded in the server’s TLS certificate — which is publicly accessible to anyone who connects to the HTTPS service — an attacker can extract the public key, forge a cookie with any username, encrypt it with the public key, and present it to the server. The server decrypts it with its private key and accepts it as valid.
Trigger conditions for exploitation:
- GlobalProtect portal or gateway is enabled and exposed
- Authentication override cookies are enabled (optional feature, enabled by default in some configurations)
- The same certificate is used for both the GlobalProtect portal/gateway HTTPS service and authentication override cookie encryption — a non-default but commonly observed configuration
Affected versions:
| PAN-OS Branch | Affected Versions | Fixed Versions |
||||
| 10.2.x | < 10.2.18-h6 | ≥ 10.2.18-h6 |
| 11.1.x | < 11.1.15 | ≥ 11.1.15 |
| 11.2.x | < 11.2.12 | ≥ 11.2.12 |
| 12.1.x | < 12.1.7 (or 12.1.4-h6) | ≥ 12.1.7 |
Prisma Access is also affected; Cloud NGFW and Panorama are not impacted.
- The Exploit Chain — From TLS Handshake to Unauthenticated VPN Access
Attackers exploit CVE-2026-0257 through a six-step chain that requires only network access to the GlobalProtect portal or gateway:
Step 1: Raw TCP Connect — The attacker establishes a raw TCP connection to the target’s GlobalProtect HTTPS endpoint (typically port 443).
Step 2: Crafted TLS ClientHello — A hand-crafted TLS ClientHello is sent to initiate the handshake. Raw TLS is used instead of Python’s `ssl` module because the module completes the full handshake internally and does not expose raw certificate bytes.
Step 3: Parse ServerHello — The server responds with its certificate chain in DER format. The attacker parses the response to extract the raw certificate bytes.
Step 4: Extract RSA Public Key — Walking the ASN.1 structure, the attacker extracts the RSA public key from the certificate.
Step 5: Forge PKCS1 v1.5 Encrypted Cookie — Using the extracted public key, the attacker forges an authentication override cookie with arbitrary username and privileges, then encrypts it.
Step 6: POST to /ssl-vpn/login.esp — The forged cookie is sent to the GlobalProtect login endpoint. The server decrypts it with its private key, finds valid plaintext, and grants VPN access.
The exploit requires no credentials, no user interaction, and no authentication — the attacker is treated as an authenticated user immediately upon presenting the forged cookie.
3. Detection — Hunting for Indicators of Compromise
Organizations must proactively hunt for signs of exploitation. Search GlobalProtect logs for successful gateway-connected events from suspicious IP addresses:
Known malicious source IPs (pre-PoC release, May 17–29, 2026):
23.128.228[.]6 104.207.144[.]154 146.19.216[.]119 146.19.216[.]120 146.19.216[.]125 179.43.172[.]213 185.195.232[.]139 198.12.106[.]60 202.144.192[.]47
Suspicious host IDs and device names observed in exploitation:
- Spoofed MAC addresses:
aa:bb:cc:dd:ee:ff, `00:11:22:33:44:55`
– Machine names:DESKTOP-GP01,GP-CLIENT,WINDOWS-LAPTOP-001, `Jocker`
Post-PoC release monitoring (after May 29, 2026):
endpoint_os_version: Microsoft Windows 10 Pro 64-bitsource_user_info.domain: empty
Linux command to grep GlobalProtect logs for IOCs:
Search GlobalProtect authentication logs for suspicious IPs grep -E "23.128.228.6|104.207.144.154|146.19.216.119|146.19.216.120|146.19.216.125|179.43.172.213|185.195.232.139|198.12.106.60|202.144.192.47" /var/log/pan/globalprotect.log Search for suspicious hostnames grep -E "DESKTOP-GP01|GP-CLIENT|WINDOWS-LAPTOP-001|Jocker" /var/log/pan/globalprotect.log Search for spoofed MAC addresses grep -E "aa:bb:cc:dd:ee:ff|00:11:22:33:44:55" /var/log/pan/globalprotect.log
Windows PowerShell command for log analysis (if logs are centralized):
Search GlobalProtect logs for IOC patterns Select-String -Path "C:\ProgramData\PaloAlto Networks\GlobalProtect\logs.log" -Pattern "23.128.228.6|104.207.144.154|146.19.216.119|146.19.216.120|146.19.216.125|179.43.172.213|185.195.232.139|198.12.106.60|202.144.192.47" Search for suspicious device names Select-String -Path "C:\ProgramData\PaloAlto Networks\GlobalProtect\logs.log" -Pattern "DESKTOP-GP01|GP-CLIENT|WINDOWS-LAPTOP-001|Jocker"
- Immediate Remediation — Patch, Workaround, and Certificate Separation
Priority 1: Patch Immediately
Upgrade to the latest fixed PAN-OS release:
| Branch | Minimum Fixed Version |
|||
| PAN-OS 10.2.x | 10.2.18-h6 |
| PAN-OS 11.1.x | 11.1.15 |
| PAN-OS 11.2.x | 11.2.12 |
| PAN-OS 12.1.x | 12.1.7 (or 12.1.4-h6) |
All GlobalProtect components should be upgraded simultaneously to maintain cookie compatibility.
Priority 2: Interim Workarounds (If Patching Is Not Immediately Feasible)
- Disable the authentication override cookie feature entirely — This removes the vulnerable functionality but may impact user experience
- Use a dedicated certificate for authentication override cookie encryption — ensure it is never shared with the GlobalProtect portal or gateway HTTPS service
Priority 3: Certificate Separation — Step-by-Step
- Generate a new certificate specifically for authentication override cookies (do not reuse existing TLS certificates)
- Configure GlobalProtect to use this dedicated certificate for cookie encryption
- Verify that the certificate used for the portal/gateway HTTPS service is different from the cookie encryption certificate
- Test authentication flows to ensure cookies are properly issued and validated
5. Monitor logs for any residual exploitation attempts
Important: If using a dedicated certificate, ensure it is not exposed through any public-facing service. The vulnerability exists because the cookie encryption certificate’s public key is obtainable — if the certificate is not exposed publicly, the attack is blocked.
- Post-Exploitation Behavior — What Happens After the Bypass
Once an attacker establishes an unauthorized VPN session, the intrusion can progress rapidly. Arctic Wolf observed follow-on activity including:
- IPSec tunnel establishment — Attackers create persistent encrypted tunnels from the assigned VPN client address
- Impacket-based reconnaissance — Internal SMB and NTLM activity consistent with Impacket tool usage (e.g.,
secretsdump.py,wmiexec.py,psexec.py) - Lateral movement attempts — Attackers probe internal networks for additional footholds
Rapid7 observed a two-wave exploitation pattern:
- Wave 1: May 17, 2026 — Initial exploitation attempts
- Wave 2: May 21, 2026 — Second wave with consistent spoofed MAC addresses, suggesting the same threat actor
Key observation: Across multiple customers, Rapid7 observed successful exploitation via authentication probes using forged cookies, but the appliance accepted the cookie without a full VPN session being established in 8 out of 10 impacted customers. Palo Alto Networks Unit 42 confirmed that only a small portion of probed devices actually established VPN sessions.
No successful lateral movement has been confirmed as of the latest reports, but the potential for internal network compromise remains severe.
- Verification — Testing Whether Your Appliance Is Vulnerable
Rapid7 released a proof-of-concept script that defenders can use to check whether an appliance is vulnerable to CVE-2026-0257. The script is available at: https://github.com/sfewer-r7/CVE-2026-0257
Using Nuclei to scan for CVE-2026-0257:
Install nuclei if not already installed go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest Run the CVE-2026-0257 template against your GlobalProtect endpoint nuclei -target https://your-globalprotect-domain.com -t ~/nuclei-templates/javascript/cves/2026/CVE-2026-0257.yaml
Manual verification steps:
- Check your PAN-OS version against the affected versions table above
2. Verify whether authentication override cookies are enabled
- Check whether the same certificate is used for both HTTPS service and cookie encryption
- Review GlobalProtect logs for any successful gateway-connected events from unknown source IPs
To check certificate usage via CLI (PAN-OS CLI):
<blockquote> show certificate <certificate-1ame> detail show global-protect portal-config show global-protect gateway-config
- Long-Term Hardening — Preventing Future Cookie-Based Authentication Flaws
CWE-565 (Reliance on Cookies without Validation and Integrity Checking) is a recurring vulnerability class. Organizations should adopt the following long-term hardening measures:
- Use digital signatures or HMAC for cookie-based authentication — encryption alone is insufficient; integrity verification is mandatory
-
Never reuse certificates across services — A certificate used for one purpose should never be reused for another, as key exposure in one context compromises all contexts
3. Implement certificate pinning for critical authentication components
-
Monitor for anomalous authentication patterns — Sudden spikes in cookie-based authentications without prior credential-based logins should trigger alerts
-
Regularly audit GlobalProtect configurations — Ensure authentication override cookies are only enabled when absolutely necessary and always use dedicated certificates
-
Deploy network segmentation — Even if VPN access is compromised, limit the attacker’s ability to move laterally
What Undercode Say
-
Key Takeaway 1: CVE-2026-0257 is a textbook example of why encryption without integrity verification is broken authentication. The server trusts any cookie that decrypts successfully — it never asks “who encrypted this?” This is the cryptographic equivalent of accepting any key that fits the lock without checking if it’s the right key.
-
Key Takeaway 2: The attack surface is massive because the RSA public key is inherently public — it’s literally in the TLS certificate presented during every HTTPS connection. This means the vulnerability is exploitable by anyone who can connect to the GlobalProtect portal, with no credentials required.
Analysis: The exploitation timeline tells a concerning story: Palo Alto Networks disclosed the vulnerability on May 13, 2026. Two days later, on May 17, 2026, the first wave of exploitation began. By May 21, 2026, a second wave hit. On May 29, 2026, CISA added it to the KEV catalog with a June 1, 2026 remediation deadline. This window — from disclosure to active exploitation — was a mere four days. Organizations that did not patch immediately were exposed within the same week. The subsequent publication of exploit code on GitHub and the availability of Nuclei templates have democratized exploitation, making it accessible to a wider range of threat actors. Arctic Wolf observed increased exploitation beginning May 30, 2026, following the public release of technical details. This pattern — initial targeted exploitation followed by mass scanning and automation — is now the standard playbook for high-severity vulnerabilities in widely deployed enterprise appliances. The lesson is clear: patch windows are measured in days, not weeks.
Prediction
- -1 Organizations that have not yet patched CVE-2026-0257 will face a surge in automated scanning and exploitation attempts over the next 30 days, as threat actors integrate the exploit into commodity vulnerability scanners and ransomware toolkits. The availability of public PoC code and Nuclei templates ensures that even low-skill attackers can leverage this vulnerability at scale.
-
-1 Successful exploitation will lead to a wave of internal network compromises, as attackers who gain VPN access will use Impacket and other post-exploitation tools to perform credential dumping, lateral movement, and data exfiltration. Organizations with insufficient internal segmentation will be at the highest risk.
-
+1 The disclosure and rapid exploitation of CVE-2026-0257 will accelerate the adoption of zero-trust network access (ZTNA) architectures and device-posture validation, as organizations recognize that VPN-centric remote access models are inherently vulnerable to authentication bypass flaws. This shift will drive increased investment in identity-aware proxies, continuous authentication, and real-time session validation.
-
-1 The vulnerability also highlights a systemic issue in enterprise firewall management: certificate reuse across services. Many organizations will discover they have been unknowingly reusing certificates, exposing them not only to CVE-2026-0257 but to similar flaws in other products. This will trigger a wave of certificate hygiene audits and remediation efforts.
-
-1 CISA’s aggressive June 1, 2026 remediation deadline for federal agencies will not be met by all organizations, leading to potential security incidents and regulatory scrutiny. Agencies that fail to comply may face operational restrictions or funding implications.
-
+1 On the positive side, the security community’s rapid response — including Unit 42’s threat brief, Rapid7’s technical analysis and PoC, and Arctic Wolf’s detection guidance — demonstrates the value of coordinated disclosure and information sharing. The Cyber Threat Alliance (CTA) members have used this intelligence to rapidly deploy protections, setting a benchmark for collaborative defense.
-
-1 The vulnerability will likely be exploited by ransomware groups to gain initial access to corporate networks, bypassing traditional perimeter defenses. Organizations in critical infrastructure, healthcare, and finance — sectors with high-value data and limited tolerance for downtime — will be particularly attractive targets.
-
+1 Palo Alto Networks’ inclusion of recovery automation (Response Effort: MODERATE, Recovery: AUTOMATIC) in their CVSS 4.0 assessment suggests that the fix is straightforward and can be applied with minimal operational disruption, enabling organizations to remediate quickly once they prioritize the update.
▶️ Related Video (90% Match):
https://www.youtube.com/watch?v=18yqPN29iZg
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Mohit Hackernews – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
