CVE-2026-0257: Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass - What It Means for Your Business and How to Respond

A critical vulnerability in widely deployed enterprise firewall and remote access technology can allow attackers to gain unauthorized entry into corporate networks without valid credentials. CVE-2026-0257 affects the GlobalProtect portal and gateway features in Palo Alto Networks PAN-OS software and related Prisma Access services. Organizations across the United States and Canada that rely on these systems for secure remote work, partner access, or hybrid connectivity face elevated risk of network intrusion, data exposure, and operational disruption. This post explains the business implications in clear terms, outlines who may be affected, shares realistic impact scenarios, and provides practical guidance on assessing exposure and responding effectively. Technical details appear only in the appendix for security teams.

Background & History

Palo Alto Networks published the advisory for CVE-2026-0257 on May 13, 2026. The vulnerability resides in the GlobalProtect portal and gateway components of PAN-OS software. It enables an attacker to bypass authentication controls and establish an unauthorized VPN connection. Panorama management systems and Cloud NGFW are not affected. The issue was discovered by Palo Alto Networks internal security research teams.

Common Vulnerability Scoring System version 3.1 rates it 9.1 (Critical) because it is network-reachable, requires no privileges or user interaction, and can compromise confidentiality and integrity. The version 4.0 score is 7.8 (High). The weakness involves improper reliance on cookies without sufficient validation and integrity checking.

Active exploitation began shortly after disclosure. Attack campaigns were observed in mid-May 2026. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on May 29, 2026, with a federal remediation deadline of June 1, 2026. Confirmed use in ransomware activity has been reported. Patches are available across supported PAN-OS and Prisma Access branches.

What This Means for Your Business

If your organization uses Palo Alto Networks firewalls or Prisma Access for remote access, this vulnerability can open a direct path into your internal network. An attacker who successfully exploits it gains a foothold that looks like a legitimate VPN session. From there they can move laterally, access sensitive systems, steal data, or deploy ransomware.

Operational impact includes potential downtime while responders isolate systems, investigate, and restore services. Data exposure risks cover employee records, customer information, intellectual property, and financial data. Reputation damage follows any confirmed breach, especially when customers or partners learn that remote access controls failed.

Compliance exposure is significant for organizations subject to U.S. and Canadian regulations. Healthcare entities face HIPAA obligations, financial institutions must address GLBA and PCI DSS requirements, and Canadian organizations must consider PIPEDA and provincial privacy laws. Failure to apply available patches promptly can be viewed as inadequate security controls during audits or regulatory inquiries. Even if you have multi-factor authentication in place, this specific bypass can circumvent normal authentication flows when the vulnerable configuration is present.

Real-World Examples

Regional Bank Remote Workforce: A mid-sized bank in the Midwest relies on GlobalProtect for hundreds of remote employees and branch staff. An attacker forges an authentication cookie, establishes a VPN session, and reaches internal banking systems. The incident triggers regulatory notifications, temporary remote access restrictions, and costly forensic review while daily operations slow.

Healthcare Clinic Network: A multi-site outpatient clinic group in Ontario uses Palo Alto firewalls with GlobalProtect for physicians accessing electronic health records from home. Unauthorized VPN access allows an attacker to reach patient data systems. The clinic faces privacy breach reporting duties under Canadian health privacy rules, potential patient notification costs, and temporary disruption of remote clinical workflows.

Manufacturing Supply Chain Partner: A mid-market manufacturer in the Great Lakes region provides limited VPN access to key suppliers through GlobalProtect. An attacker enters via the vulnerable portal, pivots into production planning systems, and disrupts order processing. The company incurs production delays, contractual penalties with customers, and emergency security consulting fees.

Professional Services Firm: A consulting practice with offices in Toronto and Chicago enables GlobalProtect for mobile staff. Successful exploitation leads to access of client project files and credentials. The firm must notify affected clients, absorb remediation costs, and manage potential loss of future business due to eroded trust.

Am I Affected?

• You run Palo Alto Networks PAN-OS version 10.2, 11.1, 11.2, or 12.1 on firewalls that have GlobalProtect portal or gateway configured.
• Authentication override cookies are enabled on the GlobalProtect portal or gateway (generate or accept cookie options checked).
• You use Prisma Access with GlobalProtect features on affected software branches prior to the fixed releases.
• Your environment reuses the same certificate for GlobalProtect HTTPS and authentication override cookie encryption.
• You have not yet upgraded to a fixed version such as PAN-OS 10.2.18-h6 or later in that branch, 11.1.15 or later, 11.2.12 or later, 12.1.7 or later (or the corresponding hotfix tracks listed by the vendor).
• You rely on GlobalProtect for employee, partner, or contractor remote access and have not verified the configuration and patch status.
• Panorama-only or Cloud NGFW-only deployments are not affected by this specific issue.

Key Takeaways

• CVE-2026-0257 allows attackers to bypass authentication and gain unauthorized VPN access to networks protected by vulnerable Palo Alto Networks GlobalProtect configurations.
• The vulnerability is actively exploited and has been linked to ransomware activity, placing organizations that have not patched at immediate risk.
• Business consequences include operational disruption, data exposure, regulatory compliance failures, and reputational harm across U.S. and Canadian organizations.
• Exposure depends on specific configuration settings, particularly whether authentication override cookies are enabled and how certificates are managed.
• Prompt patching to vendor-fixed versions, combined with configuration review, is the most effective way to eliminate the risk.

Call to Action

Do not wait for an incident to reveal gaps in your remote access defenses. Contact IntegSec today for a focused penetration test that evaluates your Palo Alto Networks environment, GlobalProtect configuration, and overall network resilience. Our team helps organizations across the United States and Canada identify weaknesses, validate remediation, and strengthen controls before attackers do. Visit https://integsec.com to schedule a consultation and take the next step toward measurable risk reduction.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause is reliance on authentication override cookies without adequate validation and integrity checking (CWE-565). When authentication override is enabled and the certificate used for cookie encryption is reused from the GlobalProtect TLS service or otherwise exposed, an unauthenticated remote attacker can forge a valid cookie. The forged cookie allows establishment of a VPN session without presenting credentials or completing multi-factor authentication.

Attack vector is network (AV:N). Attack complexity is low (AC:L). No privileges are required (PR:N). No user interaction is needed (UI:N). Scope is unchanged. Confidentiality and integrity impacts are high; availability impact is none under the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red. Official NVD entry and vendor advisory provide the authoritative references. Panorama and Cloud NGFW are unaffected.

B — Detection & Verification

Administrators can enumerate versions with the CLI command show system info or by reviewing the web interface under Device > Software. Confirm GlobalProtect configuration by navigating to Network > GlobalProtect > Portals and Gateways and inspecting Agent authentication settings for cookie generation or acceptance options.

Vulnerability scanners that include Palo Alto Networks plugins will flag affected versions and the authentication override configuration. Log indicators include unexpected GlobalProtect authentication success events for accounts that did not complete normal login, sessions originating from unusual source IP addresses or autonomous system numbers, and authentication override cookie usage without corresponding prior authentication records. Behavioral anomalies include sudden spikes in VPN session establishments from previously unseen geolocations or infrastructure providers known for scanning activity. Network indicators of exploitation involve HTTP requests that present crafted authentication override cookies to the GlobalProtect portal or gateway endpoints.

C — Mitigation & Remediation

1. Immediate (0–24h): Identify all GlobalProtect-enabled firewalls and Prisma Access instances. Disable authentication override cookie generation and acceptance if the feature is not essential. Apply temporary network restrictions limiting GlobalProtect portal and gateway access to known trusted source ranges where operationally feasible. Monitor logs for anomalous VPN session creation.
2. Short-term (1–7d): Upgrade all affected PAN-OS systems to fixed versions: for 10.2 branch, 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 or later; for 11.1, the corresponding fixed hotfixes or 11.1.15; for 11.2, fixed hotfixes or 11.2.12; for 12.1, 12.1.4-h6 or 12.1.7 or later. Prisma Access customers should confirm upgrade status with the vendor schedule. Upgrade all portals and gateways together to avoid cookie compatibility issues. After upgrade, users may need to re-authenticate once.
3. Long-term (ongoing): Generate and use a dedicated certificate solely for authentication override cookies; never reuse the portal or gateway TLS certificate. Maintain a current inventory of PAN-OS versions and configurations. Integrate regular vulnerability scanning and configuration reviews into change management. Subscribe to Palo Alto Networks security advisories and CISA KEV updates. Conduct periodic penetration tests focused on remote access pathways.

D — Best Practices

• Maintain strict separation of certificates used for GlobalProtect TLS termination versus authentication override cookie encryption.
• Disable authentication override features unless a documented business requirement exists and compensating controls are in place.
• Enforce least-privilege access and continuous monitoring of VPN session establishment events.
• Keep all PAN-OS and Prisma Access components on supported, patched versions and validate patch application through configuration management.
• Incorporate remote access authentication bypass testing into regular penetration testing and red team exercises.