PAN-OS GlobalProtect authentication bypass (CVE-2026-0257)

Per the vendor, the issue affects firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled and a specific certificate configuration exists. Affected PAN-OS: 12.1 before 12.1.4-h6 and 12.1.7; 11.2 before 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 and 11.2.12; 11.1 before 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15; 10.2 before 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6. Prisma Access 11.2 and 10.2 are affected until upgraded. All older unsupported PAN-OS versions must move to a supported fixed version. Palo Alto Networks published its advisory on 13 May 2026. The vendor says it found the issue internally. Its exploitation status reads that it is aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied. The advisory was updated on 3 June 2026. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on 29 May 2026, with a due date of 1 June 2026. The KEV entry flags known use in ransomware campaigns. The sources opened here give no date for first exploitation. On 19 October 2026 Unit 42, the threat research team of Palo Alto Networks, updated its threat brief on this flaw. It says ransomware operators attempt to exploit CVE-2026-0257, including Spikey Scorpius, also known as Qilin ransomware, and Tarnished Scorpius, also known as INC. Unit 42 says attackers use the flaw to gain a first foothold and then bypass multi-factor authentication to set up a VPN session. The same brief lists indicators of compromise.

On 21 October 2026 Group-IB and NyxLab reported that Group-IB analysts observed exploitation of CVE-2026-0257 for initial access. The campaign's likely main operators include an actor they call k0t. The tool they describe forges an authentication override cookie, sends it to the GlobalProtect login endpoint and then uses the cookie to open a VPN session through OpenConnect.