PAN-OS GlobalProtect Authentication Bypass: Safe Versions and Exploitation Status

PAN-OS, the operating system behind Palo Alto Networks' GlobalProtect VPN — widely used to let employees reach corporate networks from home or on the road — has an authentication bypass vulnerability, tracked as CVE-2026-0257, that allows an attacker with no valid ID or password to connect into the internal network anyway. The conclusion first: if your PAN-OS is on 12.1.7 or later (12.1.4-h6 or later on that maintenance branch), 11.2.12 or later, 11.1.15 or later, or 10.2.18-h6 or later, the flaw is already fixed and no action is needed. Any current release — including 12.1.8, the latest in the 12.1 line as of July 2026 — is fine. Devices still running anything older, however, need updating now: as covered below, this flaw has served as the initial entry point for real Qilin ransomware intrusions.

The flaw lives in the operating system that powers these VPN features: PAN-OS. PAN-OS runs Palo Alto Networks firewalls — the gatekeeping appliances that sort traffic between inside and outside — and GlobalProtect is the gateway on top of it that accepts secure connections from outside. CVE-2026-0257 is an authentication bypass: it lets an attacker skip identity verification at that gateway and establish an unauthorized VPN connection.

The severity rating is split between scoring bodies. Palo Alto Networks itself rates it 7.8 (High) on the newer CVSS 4.0 scale, while the U.S. National Institute of Standards and Technology (NIST) rates it 9.1 (Critical) on the older CVSS 3.1 scale. The number matters less than one fact: this flaw has been used in real attacks. Security firm Rapid7 observed exploitation across multiple customer environments in mid-May 2026, and on May 29 the U.S. cybersecurity agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog (the June 1, 2026 remediation deadline it set for federal agencies has long passed). Then in July 2026 it emerged that the flaw had been the initial entry point in multiple Qilin ransomware intrusions during June, and the KEV catalog now classifies it as known to be used in ransomware campaigns.

A Forged Badge Walks Into Your Network — and What Walks Back Out

Hearing "someone makes an unauthorized VPN connection" makes it hard to picture which part of your own company is at risk, so let's first sketch what an attacker is actually after when they reach for this hole. A VPN is the entrance that lets employees outside the building pass into the internal network. Being able to walk through it while impersonating a legitimate employee means the attacker can stand inside the company's building without anyone's permission.

The people who truly want this entrance are not thrill-seeking pranksters. They are initial access brokers who resell the foothold to other crews, ransomware operators who buy that foothold to encrypt files and demand a ransom, industrial spies who leak blueprints and quotes to a competitor, state-aligned groups from China, Russia, or North Korea acting on government orders, and resellers who hawk stolen employee accounts on underground markets. Once inside the VPN, what they hunt for is the customer lists and contracts on the file server, the salaries and national ID numbers in the HR database, the wire-transfer screen of the finance system, the Active Directory that holds every employee's password, and an admin account they can use for the next break-in. The moment a forged connection cookie clears the gate, the attacker drops from outside the company straight into the middle of the internal LAN and starts reaching for every one of those things, one after another.

VPN appliances and firewalls are the "trusted point" on the boundary between inside and outside. That is exactly why they are so valuable to attackers: punch through that single layer and lateral movement across the inside, and the work of planting a long-term foothold that no one notices, both get dramatically easier. Palo Alto's GlobalProtect has been here before — in 2024 the unauthenticated remote code execution flaw CVE-2024-3400 was abused by state-aligned actors, proving this product's entrance is a first-class target that attackers come back to again and again. This authentication bypass simply cuts one more keyhole into that same well-watched door.

The 7.8 from the vendor and the 9.1 from NIST are just markings on a technical severity ruler. What a company actually stands to lose is this: the VPN installed to enable remote work turns, wholesale, into an outside crew's "service entrance with a copied key," and through leaked customer data, encrypted core systems, and knock-on damage to business partners, the business itself can grind to a halt. The very device that made remote work convenient flips into the shortest path in — that is the real weight of this vulnerability.

What Are PAN-OS and GlobalProtect?

Palo Alto Networks is a U.S. company and the world's largest maker of enterprise network security gear. Its flagship product is the "next-generation firewall," a gatekeeper appliance placed between inside and outside that sorts traffic and blocks dangerous connections. The operating system that runs this appliance is PAN-OS.

Running on top of it, GlobalProtect is the VPN feature that lets off-site employees connect securely into the corporate network. It supports access from home or while traveling: employees install a dedicated app on their PC or phone and, after identity verification, enter the company network. With remote work spreading since the pandemic, many companies, government bodies, and universities worldwide have deployed this kind of VPN, and Palo Alto's GlobalProtect is one of the leading options.

The identity-verification side has two roles: the "portal" that first accepts access, and the "gateway" that actually establishes the VPN tunnel. This vulnerability affects both. By contrast, Panorama, which centrally manages multiple firewalls, and the cloud-delivered Cloud NGFW are not affected. What is at risk is any environment that runs PAN-OS as a physical (or virtual) appliance and has GlobalProtect enabled.

What Happens: A Forged Cookie Passes as the Real Thing

The heart of this vulnerability is a weakness in GlobalProtect's "authentication override cookie" mechanism. The idea is convenience: once a user logs in, they are issued a cookie (a small token of credential data handed to the browser), and on subsequent visits they can present that cookie to skip logging in again. It exists to save employees effort — but there was a trap in it.

According to Rapid7's technical analysis, if the certificate GlobalProtect uses to encrypt and decrypt these cookies is shared with another feature such as the HTTPS service, an attacker can obtain that certificate's public key from outside. With the public key in hand, the attacker can forge arbitrary authentication override cookies, and when those forged cookies are sent to the server, the server decrypts them correctly, trusts them as genuine, and lets the attacker through identity verification.

The vulnerability database NVD classifies this flaw as CWE-565 (reliance on cookies without validation and integrity checking), pointing precisely at the fact that the server trusted the cookie without sufficiently verifying whether its contents had been tampered with or whether it had truly issued the cookie. The prerequisites for attack are extremely low — network-based, no authentication, no special privileges, no user interaction — and Palo Alto Networks itself rates the attack complexity as low.

Conversely, environments that do not use the authentication override cookie feature, or that use a dedicated certificate for cookies, are not exposed via this path. Still, configurations that use authentication override cookies for SAML authentication or clientless VPN are common, so do not assume "we're fine" — strongly consider running the configuration check described below.

Affected Versions and Fixes

According to Palo Alto Networks' official advisory, the affected and fixed versions break down by PAN-OS branch as follows. Check your version and update to the fixed release (or later) in the same branch.

Multiple fixed versions appear within a single branch because each branch is further split into maintenance sub-branches. Pick the fixed version that matches the sub-branch you run (or any newer version). For exact version checks and the corresponding fixes, the list in the official advisory is authoritative. Note that the cloud-delivered Cloud NGFW and the management product Panorama are reported as not affected.

As of July 23, 2026, the latest release in the 12.1 line is 12.1.8 (released July 2026), which is newer than the fixed versions in the table, so staying on the current release resolves this vulnerability. Note also that new PAN-OS flaws have kept appearing since CVE-2026-0257 was fixed: in June and July 2026 the vendor disclosed CVE-2026-0273 (an authenticated administrator can run arbitrary commands as root, the all-powerful system account), CVE-2026-0272 (CLI privilege escalation), CVE-2026-0269 (a denial-of-service in tunnel traffic), CVE-2026-0281 (information disclosure in the management web UI), and CVE-2026-0288 (a buffer overflow in the User-ID Terminal Server Agent). None of these is KEV-listed as of July 23, 2026, but they are one more reason to run the current maintenance release of your branch rather than stopping at the minimum fixed version.

How the Exploitation Unfolded: Rapid7's Observations

That this never stayed a theoretical risk is shown by observations from Rapid7's managed detection and response (MDR) service. Rapid7 detected the first attack on May 17–18, 2026, confirming suspicious cookie authentication to the local admin account across multiple customer environments. Analysis of tech support files showed the Cloud Authentication Service (CAS) was disabled and authentication override cookies were enabled — exactly the vulnerable configuration. Rapid7 Labs confirmed a successful proof-of-concept (PoC), corroborating that this was exploitation of CVE-2026-0257.

A second wave followed on May 21. In this wave, following successful cookie authentication, a VPN IP address was assigned to the attacker, granting access to the internal network. However, only a subset of environments reached this stage; in 8 of the 10 impacted customers, the forged cookie was accepted but a full VPN session was not established. Even so, the fact that the authentication barrier had been breached remains. Because the MAC address used in both waves was the same, Rapid7 believes they are the work of the same actor.

The post is from Stephen Fewer, a principal security researcher at Rapid7. As sources of the attacks, Rapid7 cites IP addresses at the hosting provider Vultr (104.207.144.154) and Dromatics Systems (146.19.216.119/120/125). In the verification work below, it is worth checking your logs for access or login traces from these IPs.

What Came Next: An Entry Point for Qilin Ransomware

According to a threat brief published on June 9, 2026 by Unit 42, Palo Alto Networks' own threat research team, exploitation had begun even before the proof-of-concept (PoC — demonstration code showing the attack works) was published on May 29. The attackers have not been identified, and of the devices that were probed, only a small fraction saw an actual VPN session established. At that point the situation was still "the wall was breached, but the damage beyond it stayed limited."

That changed in July. Research by the security firm Arctic Wolf Labs (reported on July 21, 2026) found that multiple intrusions by Qilin ransomware — a criminal crew that encrypts data and demands payment — throughout June 2026 had all used CVE-2026-0257 as their initial entry point. After entering the internal network with forged cookies, the attackers modified the Windows registry (the system's settings store) to keep their foothold, installed remote-access tools such as AnyDesk, Ngrok, and LogMeIn, dumped memory from LSASS (the internal Windows process that handles password data) to steal employee credentials, extracted Active Directory data, moved laterally to other machines with the admin tool PsExec, and finally deployed the ransomware via a win.exe placed in C:\PerfLogs\.

Following this, CISA's KEV catalog updated its classification of CVE-2026-0257 to "known use in ransomware campaigns" (confirmed in the July 23, 2026 edition). The damage scenario sketched earlier in this article — from a VPN hole to ransomware — is no longer hypothetical; it happened. For devices still unpatched, this vulnerability has moved well past the "limited exploitation attempts" stage.

From Disclosure to Ransomware Exploitation

← Swipe to move

Clues to Check Whether You Were Already Hit

Using the indicators of compromise (IoCs — clues for spotting traces of an attack) that Rapid7 published, you can do a basic check for whether you have already been targeted. Look in your GlobalProtect logs and VPN connection records for traces like the following.

Pay particular attention to successful VPN authentication against the local admin account and to GlobalProtect connections from unfamiliar hostnames or MAC addresses. If these appear in your past logs, you may already be compromised, so alongside patching you need to move to your incident response procedures. Keep in mind the IPs and MAC above are only examples; attacks could well come from other sources.

What to Do If You Are Still Unpatched

1. Update PAN-OS to a fixed version. Upgrade to the fixed version (see the table above) or later for the PAN-OS branch you run. This flaw has already served as the initial entry point for real ransomware intrusions, so updating is both the top priority and the permanent fix. Follow the official advisory for version checks and mappings.

2. If you can't update immediately, apply a mitigation. Palo Alto Networks offers two interim workarounds. One is to issue a dedicated certificate for authentication override cookies and not share it with other features. The other is to disable the authentication override feature entirely (uncheck "generate cookie" and "accept cookie" in the GlobalProtect configuration). Simply cutting the certificate reuse breaks the precondition for cookie forgery.

3. Review past logs. Check GlobalProtect logs and VPN connection records from May 13, 2026 (the disclosure date) through the present. Ransomware intrusions via this flaw actually occurred in June, so do not cut the review window off at May. Look for the IoCs above, suspicious local-admin logins, and unfamiliar hostnames or MAC addresses — plus registry modifications and remote-access tools you never installed, such as AnyDesk or Ngrok. If you find traces, respond on the assumption of compromise.

4. Reassess what is exposed. Because the GlobalProtect portal/gateway is exposed to the internet by design, you can't reduce the attack surface to zero, but restricting the management interface (web UI) to internal or specific IPs and trimming unnecessary public settings are sound basics that help here and beyond.

5. Rotate credentials. If compromise cannot be ruled out, reissue passwords for accounts tied to the VPN and the GlobalProtect local admin credentials. If an attacker was already inside, patching alone won't evict them.

What KEV Listing Means, and the Hub Article

CISA's Known Exploited Vulnerabilities (KEV) catalog lists only vulnerabilities CISA has confirmed are actively used in attacks. Being on it means a real, demonstrated threat rather than a theoretical risk, and it creates a legal remediation obligation for U.S. federal agencies. CVE-2026-0257 was added on May 29, 2026, with a June 1 deadline that has since passed. As of the July 23, 2026 edition of the catalog, the flaw is classified as having known use in ransomware campaigns. The catalog also lists a separate PAN-OS flaw, CVE-2026-0300 (an out-of-bounds write), added on May 6, 2026. None of this is legally binding outside the U.S., but "attacks happened, and the flaw became a ransomware entry point" is reason enough for any IT team to leave no device unpatched.

On this site, we continuously update the list of CISA-confirmed actively-exploited CVEs and their deadlines on our CISA KEV dashboard (Japanese). This Palo Alto Networks PAN-OS case fits the same classic "boundary-device authentication bypass" pattern as previously KEV-listed VPN and firewall gear (Citrix, Ivanti, Cisco, Fortinet). When one appliance on the boundary is broken, the whole internal network is exposed — a structure these products share.

Palo Alto's GlobalProtect was also abused by state-aligned actors in 2024 via CVE-2024-3400, and it remains a target attackers come back to. VPNs and firewalls are not "install it and you're safe" devices; the practical lesson from this case is to run them on the premise that, as long as they are exposed, they must be kept updated as a top priority.

Sources

• ▸ NVD - CVE-2026-0257
• ▸ Palo Alto Networks Security Advisory - CVE-2026-0257
• ▸ Rapid7 - Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ Unit 42 - Active Exploitation of PAN-OS CVE-2026-0257 (June 9, 2026)
• ▸ Cyber Security News - Qilin Ransomware Exploiting CVE-2026-0257 (coverage of Arctic Wolf Labs research)
• ▸ Cyber Security News - New PAN-OS vulnerabilities of June 2026 (CVE-2026-0273 and others)
• ▸ Palo Alto Networks - PAN-SA-2026-0010 (CVE-2026-0288)
• ▸ endoflife.date - PAN-OS release list
• ▸ Stephen Fewer (Rapid7) on X
• ▸ Palo Alto Networks - GlobalProtect product page
• ▸ NVD - CVE-2024-3400 (2024 GlobalProtect zero-day)