CVE-2026-0257 Explained: The PAN-OS GlobalProtect Authentication Bypass

Key Takeaways

• CVE-2026-0257 is a high-severity authentication bypass in PAN-OS GlobalProtect portal and gateway, actively exploited in the wild.
• A remote, unauthenticated attacker can forge a valid session cookie and establish an unauthorized VPN connection.
• The flaw stems from trusting decrypted cookies without integrity checks, combined with certificate reuse leaking the encryption key.
• A public proof-of-concept exists, harvesting public keys from TLS to forge cookies for privileged accounts like admin.
• The Picus Platform simulates CVE-2026-0257 attacks to test security control effectiveness against real-life exploitation.

CVE-2026-0257 is a high-severity authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS.

When a specific configuration is present, a remote, unauthenticated attacker can forge a valid session cookie, skip login entirely, and establish an unauthorized VPN connection into the internal network. It was published on May 13, 2026, added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026, and is being actively exploited in the wild.

This post breaks down what the vulnerability is, why it happens, how attackers can abuse it, how to tell if you are exposed, and how to fix it.

Key facts at a glance

What Are PAN-OS and GlobalProtect?

PAN-OS is the operating system that runs on Palo Alto Networks next-generation firewalls and security appliances. It handles routing, threat prevention, and policy enforcement for enterprise networks.

GlobalProtect is the remote-access VPN feature built into PAN-OS. It lets employees connect securely to corporate resources from anywhere through two components: a portal (which delivers configuration to clients) and a gateway (which terminates the VPN tunnel). Because GlobalProtect sits at the network edge and is internet-facing, any authentication weakness in it carries serious risk.

Root Cause Analysis of CVE-2026-0257

The vulnerability lives in a GlobalProtect feature called authentication override, and the defect can be traced directly through the GlobalProtect service binary (/usr/local/bin/gpsvc). The decompiled functions below come from analysis of a PAN-OS appliance running in a vulnerable configuration [1]. We walk the code path from the incoming request down to the exact point where trust is misplaced.

What authentication override does

Authentication override lets a portal or gateway issue a cookie to a user who has already logged in. On later connections, the client can present that cookie instead of re-entering credentials, much like a bearer token, until the cookie expires. This feature is not enabled by default.

The cookie carries a small set of fields: username, domain, host ID, client OS, remote address, and a timestamp (used to enforce a lifetime). It is encrypted before being handed to the client and decrypted by the appliance when it comes back.

Step 1: The login handler routes cookie requests to a cookie-only auth path

When a POST request hits /ssl-vpn/login.esp, the main_DoAuthLogin function inspects the form values. If either portal-userauthcookie or portal-prelogonuserauthcookie is present, it skips credential authentication and hands the request to main_AuthWithCookie.

Step 2: The cookie is decrypted, and the result is used as identity

main_AuthWithCookie takes the encrypted cookie and immediately calls the decryption routine (main_DecryptAppAuthCookie). The values it gets back (user, domain, host ID, client OS, remote address, timestamp) become the authenticated identity for the session.

Step 3: Decryption succeeds, and the plaintext is trusted with no integrity check

Here is the heart of CVE-2026-0257. main_DecryptAppAuthCookie base64-decodes the cookie and decrypts it with the RSA private key. The decrypted contents are then parsed and returned as-is. There is no additional check, such as HMAC verification or signature check, and no proof that the appliance itself produced the cookie.

The code treats "the ciphertext decrypted into something parseable" as equivalent to "this cookie is authentic." Those are not the same thing.

Step 4: Certificate reuse hands the attacker the key needed to forge

Decryption alone would still be safe if the attacker could not produce ciphertext that decrypts correctly. With RSA, you encrypt with the public key and decrypt with the private key. The appliance holds the private key, so in principle, only the appliance can mint a cookie.

The problem is which certificate feeds privateCert above. Palo Alto Networks guidance is explicit: do not reuse the portal or gateway certificate for authentication override, and do not share it with other features. When an operator violates that and uses the same certificate for something else (e.g., for the HTTPS service of the portal or gateway), the public key is no longer secret. TLS hands the full certificate (and therefore the public key) to anyone who connects:

Now the attacker can build the plaintext fields and encrypt them with that public key. Notice that the chosen username is fully attacker-controlled, which is why exploitation in the wild targets privileged local accounts, such as the admin account:

Putting it together

The bypass is the product of two flaws that are individually survivable but fatal in combination:

1. No integrity verification after decryption (Step 3). Successful RSA decryption is mistaken for authenticity. No HMAC or signature ties the cookie to the appliance that issued it.
2. Certificate reuse leaks the encryption key (Step 4). Sharing the HTTPS certificate with the cookie feature publishes the public key to every client, which is all an attacker needs to encrypt a forged cookie.

How Threat Actors Can Exploit CVE-2026-0257

A public proof-of-concept already exists [2], so the barrier to exploitation is low.

It works without any credentials: the tool connects to the target over TLS and automatically reads the certificate chain the server presents during the handshake, extracts the public key from each certificate, and uses it to produce a forged authentication override cookie.

Because the right certificate is not always obvious, the PoC simply iterates over every public key in the chain, encrypts a cookie with each one, and submits it to the GlobalProtect login endpoint until the appliance accepts one. A successful run returns a working cookie that grants an authenticated session.

Here is an example output of PoC:

Am I Vulnerable to CVE-2026-0257?

You are exposed only if both conditions are true: authentication override cookies are enabled, and the cookie certificate is reused (for example, shared with the HTTPS service).

To check, in the PAN-OS management interface, confirm whether cookie options are enabled [3].

• On the Portal: Network > GlobalProtect > Portals > (your portal) > Agent > (config) > Authentication, and look for "Generate cookie for authentication override" or "Accept cookie for authentication override."
• On the Gateway: Network > GlobalProtect > Gateways > (your gateway) > Agent > Client Settings > Authentication Override, and look for "Accept cookie for authentication override."

If this setting is enabled on Portal or Gateway and the certificate is shared, treat the device as vulnerable.

How to Mitigate and Remediate CVE-2026-0257

Patch first. The permanent fix is upgrading to a fixed PAN-OS release. After patching, GlobalProtect users re-authenticate once because the appliance regenerates cookies using stronger, integrity-checked validation.

If you cannot patch immediately, apply one of the vendor workarounds: generate a new certificate used exclusively for authentication override cookies (do not reuse the portal, gateway, or HTTPS certificate), or disable authentication override entirely by unchecking the cookie generate and accept options. Then hunt your GlobalProtect logs for the indicators above.

How Picus Simulates CVE-2026-0257 Attacks?

We also strongly suggest simulating CVE-2026-0257 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the CVE-2026-0257 attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] Rapid, “Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257),” Rapid7. Accessed: Jun. 17, 2026. [Online]. Available: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

[2] “GitHub - sfewer-r7/CVE-2026-0257: Proof-of-concept script to leverage the PAN-OS GlobalProtect authentication bypass CVE-2026-0257,” GitHub. Accessed: Jun. 17, 2026. [Online]. Available: https://github.com/sfewer-r7/CVE-2026-0257

[3] P. Psirt, “CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities,” Palo Alto Networks Product Security Assurance. Accessed: Jun. 17, 2026. [Online]. Available: https://security.paloaltonetworks.com/CVE-2026-0257