When the Front Door Has a Skeleton Key: The GlobalProtect Authentication Bypass (CVE-2026-0257)

On May 13, 2026, Palo Alto Networks published an advisory for CVE-2026-0257, an authentication bypass affecting the GlobalProtect portal and gateway in PAN-OS. By May 17, threat actors were already exploiting it in the wild. On May 29, CISA added it to the Known Exploited Vulnerabilities catalog, putting federal civilian agencies on a hard remediation deadline and signaling to everyone else that this is no longer theoretical. If you run GlobalProtect, this one deserves your attention today, not next maintenance window.

What the flaw actually is

CVE-2026-0257 lets a remote, unauthenticated attacker establish a VPN connection through an affected GlobalProtect gateway. No credentials. No phishing. No malware dropper. Just a forged token that the firewall trusts.

Here is the part worth understanding, because it is also the part that tells you whether you are exposed.

GlobalProtect has an optional feature called authentication override. When enabled, the portal or gateway issues a cookie to a user who has already authenticated, and that cookie can be presented on later connections in place of re-entering credentials. Think of it as a bearer token for VPN access. It is not on by default, which is the first piece of good news.

Those cookies are encrypted and decrypted using a certificate. The vulnerability lives in how that certificate is handled. The decrypted cookie contents are trusted implicitly, with no signature verification after decryption. So anyone who can encrypt a cookie with the correct public key can mint a valid one for any user they like, including the local admin account.

That raises the obvious question: how would an attacker get the right public key? This is the second precondition, and it is the one that turns a niche feature into an internet-facing risk. If the certificate used for authentication override cookies is also reused somewhere public, such as the HTTPS service on the same portal or gateway, then the public key is sitting right there for anyone to retrieve over TLS. Rapid7 Labs demonstrated exactly this, walking the certificate chain, forging an override cookie against each public key, and watching the gateway accept the forgery.

So the attack only works when two conditions are both true:

1. The authentication override feature is enabled on the portal or gateway, and
2. The certificate used for those override cookies is shared with another feature, rather than being dedicated to override use only.

If you have never enabled authentication override, you are not exposed to this specific issue. If you enabled it and gave it its own dedicated certificate, you are also in good shape. The danger zone is the common middle ground: override enabled, certificate reused.

Who is affected

The advisory lists impact across several PAN-OS trains and Prisma Access:

• PAN-OS 12.1, 11.2, 11.1, and 10.2 (specific maintenance releases, see below)
• Prisma Access 11.2 and 10.2

Cloud NGFW is reported as not affected, which narrows the blast radius for organizations standardized on that platform.

Because the flaw spans both current and older branches, mixed environments are the real headache. A single device left on an unpatched 10.2 or 11.1 release can undo the work you did patching everything else. Version verification across the fleet matters as much as the patching itself.

The fixed releases, per the Palo Alto advisory, include (among others):

• PAN-OS 12.1: 12.1.4-h6, 12.1.7 and later
• PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 and later
• PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 and later
• PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 and later
• Prisma Access: 11.2.7-h13, 10.2.10-h36 and later

Always confirm against the live vendor advisory before you schedule, since hotfix availability shifts.

Do not let the CVSS score lull you

CVE-2026-0257 carries a CVSSv4 base score of 7.8, which the scale labels medium. That number understates the operational reality, and Rapid7 said as much when it urged organizations to treat the issue as critical priority.

Here is why the math and the risk diverge. An authentication bypass on an internet-facing VPN appliance is one of the cleanest initial access vectors a threat actor can ask for. The base score reflects a narrow technical impact in isolation. The business risk reflects what sits behind that gateway: your internal network, your domain, your crown jewels. A scoring rubric and a breach do not weigh the same way, and treating "medium" as "later" is how unpatched edge devices become the headline in someone else's incident report.

This is a recurring theme. GlobalProtect and the broader PAN-OS edge have drawn repeated attacker interest in 2026 alone, including a denial-of-service flaw earlier in the year. Remote access infrastructure now warrants the same urgency once reserved for domain controllers and public web servers, because in a great many intrusions it is the bridge between the two.

What to do right now

If you run GlobalProtect, here is the short list, in order:

1. Determine exposure. Check whether authentication override is enabled on any portal or gateway, and whether the override certificate is shared with another feature. If both are true, treat the device as actively at risk.
2. Apply the interim mitigation. Per Palo Alto's guidance, either disable the authentication override feature or generate a new certificate used exclusively for authentication override. Either step closes the door while you schedule patching.
3. Patch on an urgent basis. Upgrade affected appliances to a fixed release. Verify every device, including the easy-to-forget ones on older trains.
4. Hunt for prior compromise. A mitigation stops future abuse. It does not tell you whether someone already walked in. Review GlobalProtect authentication logs for cookie-based logons to the local admin account, VPN authentications from low-cost hosting providers, repeated or spoofed client MAC addresses, and generic or default client hostnames. These were the fingerprints in the observed exploitation.

How ADK Cyber can help

This is the kind of event ADK Cyber is built for. We live inside the Palo Alto Networks ecosystem every day, across PAN-OS, Panorama, GlobalProtect, Cortex XDR, and Prisma Access, and we hold the PCNSE and Panorama certifications to back it up. That means we can move from "is this advisory relevant to us" to "we are patched, verified, and clean" without a long ramp-up.

Concretely, here is what we deliver for CVE-2026-0257 and events like it:

• Rapid exposure assessment. We audit every portal and gateway across your environment to confirm whether authentication override is enabled and whether certificates are being reused. You get a clear, prioritized list of which devices are actually at risk rather than a generic "you might be affected."
• Certificate hygiene review. The root cause here is certificate reuse, and that pattern rarely lives in just one place. We review your GlobalProtect and PAN-OS certificate usage end to end, and recommend a dedicated-certificate model that removes this class of risk going forward.
• Patch planning across mixed fleets. Using Panorama device group and template stack awareness, we map your installed PAN-OS versions, identify the correct fixed release for each train, and build a sequenced upgrade plan that accounts for your maintenance constraints. Mixed environments are where remediation quietly fails, and that is exactly where we focus.
• Compromise hunt and detection tuning. We comb your GlobalProtect authentication logs for the indicators tied to this campaign and stand up or tune detections in Cortex XDR so the next forged-cookie attempt surfaces immediately rather than weeks later.
• Hardening beyond the patch. A fix for today's CVE is not a security posture. We help you tighten GlobalProtect configuration, reduce unnecessary internet exposure, and put monitoring around your remote access edge so it gets the scrutiny it deserves.

The organizations that come through events like this in good shape are the ones that already know where their doors are, how each one is locked, and who is watching when someone tries the handle. If you are not certain about all three for your GlobalProtect deployment, that is precisely the conversation to have now.