Log in Request a demo

Exploited vulnerability

PAN-OS GlobalProtect authentication bypass (CVE-2026-0257)

CVE-2026-0257

CVE-2026-0257 is a flaw in the GlobalProtect VPN portal and gateway of Palo Alto Networks PAN-OS firewalls.

  • On CISA KEV
CVE ID
CVE-2026-0257
CISA KEV
Listed
Affected product
PAN-OS (GlobalProtect portal and gateway) and Prisma Access
Exploited
Yes
Published
May 2026

In short

CVE-2026-0257 is a flaw in the GlobalProtect VPN portal and gateway of Palo Alto Networks PAN-OS firewalls. It lets an attacker skip the login checks and open a VPN connection without permission. CISA lists it as exploited and flags known ransomware campaign use.

Profile MapVulnerability
  1. CVECVE-2026-0257
  2. ProductPalo Alto Networks PAN-OS (GlobalProtect portal and gateway) and Prisma Access
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listedUpgrade to a fixed version · Expect one re-login

What it allows

An attacker with no account can bypass security restrictions and establish an unauthorized VPN connection into the network behind the firewall. NVD's primary score is 9.1 (CVSS v3.1). The vendor scores it 7.8 (High) on CVSS v4.0 and gives it its highest urgency rating. Panorama and Cloud NGFW are not affected.

Who is affected

Per the vendor, the issue affects firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled and a specific certificate configuration exists. Affected PAN-OS: 12.1 before 12.1.4-h6 and 12.1.7; 11.2 before 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 and 11.2.12; 11.1 before 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15; 10.2 before 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6. Prisma Access 11.2 and 10.2 are affected until upgraded. All older unsupported PAN-OS versions must move to a supported fixed version.

Palo Alto Networks published its advisory on 13 May 2026. The vendor says it found the issue internally. Its exploitation status reads that it is aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied. The advisory was updated on 3 June 2026.

CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on 29 May 2026, with a due date of 1 June 2026. The KEV entry flags known use in ransomware campaigns. The sources opened here give no date for first exploitation and name no group or malware behind it, so attribution is not public.

The vendor points to its own threat brief for indicators of compromise. This page does not rely on it.

What to do

  1. Upgrade to a fixed version

    Move to the fixed build for your train, for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6 or later, or the hotfix named in the advisory. Upgrade every portal and gateway that creates or accepts the cookies, and the on-prem firewalls in hybrid Prisma Access setups.

  2. Expect one re-login

    After the upgrade the firewall regenerates the override cookie more securely, so GlobalProtect users must sign in again once.

  3. Mitigate if you cannot patch yet

    The vendor offers two steps. Use a new certificate used only for authentication override cookies, never shared with the portal or gateway. Or turn off the Authentication Override options for generating and accepting cookies on the portal and gateway.

  4. Detect and hunt

    Check whether authentication override cookies are enabled on your portals and gateways, using the menu steps in the advisory. Review GlobalProtect sign-ins for VPN sessions that did not start with a normal login, and use the vendor's published indicators.

  5. Treat exposed gateways as suspect

    Because exploitation is confirmed, check unpatched gateways for unknown VPN sessions and the accounts and networks they reached.

Questions

What is CVE-2026-0257?

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS firewalls. An attacker with no account can open an unauthorized VPN connection into the network behind the firewall. NVD scores it 9.1.

Which systems are affected by CVE-2026-0257?

Firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled and a specific certificate configuration exists. Several PAN-OS 10.2, 11.1, 11.2 and 12.1 builds and Prisma Access are affected. Panorama and Cloud NGFW are not.

Is CVE-2026-0257 being exploited?

Yes. The vendor reports limited exploit attempts on unpatched devices, and CISA added the flaw to the Known Exploited Vulnerabilities catalog on 29 May 2026 with ransomware use flagged. No group or malware is publicly named.

How do I fix or mitigate CVE-2026-0257?

Upgrade to the fixed build for your PAN-OS train, for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6. If you cannot patch yet, use a separate certificate only for override cookies, or turn off the Authentication Override options.

In our research

  1. Five edge VPN flaws CISA flags for ransomware use October 2026

Sources

  1. CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Palo Alto Networks
  2. CVE-2026-0257 record NIST NVD
  3. CISA Adds One Known Exploited Vulnerability to Catalog CISA
  4. Known Exploited Vulnerabilities catalog CISA

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more