CISA has listed CVE-2026-0257 in its Known Exploited Vulnerabilities (KEV) catalogue since 29 May 2026, and the entry is marked for known ransomware use. If a GlobalProtect deployment slipped through the May patch cycle, or was patched without anyone checking the logs from before the fix, now is the time to close that gap.
What is affected
The flaw sits in GlobalProtect’s authentication override feature, which issues a cookie so that a returning user doesn’t have to sign in again. The feature is off by default. According to Palo Alto Networks, a firewall is exposed only when:
- a GlobalProtect portal or gateway is configured, and
- authentication override cookies are enabled (generate or accept on the portal, accept on the gateway), and
- the certificate that protects those cookies is also used by another feature, such as the portal or gateway’s own HTTPS certificate.
When those conditions are met, an unauthenticated attacker can open a VPN session without valid credentials. Panorama and Cloud NGFW are not affected.
| Branch | Fixed in (minimum for your train, or the latest) |
|---|---|
| PAN-OS 12.1 | 12.1.4-h6 or 12.1.7 and later |
| PAN-OS 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later |
| PAN-OS 11.1 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later |
| PAN-OS 10.2 | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later |
| Prisma Access 11.2 | 11.2.7-h13 and later (check the Palo Alto Networks advisory for upgrade status) |
| Prisma Access 10.2 | 10.2.10-h36 and later (check the Palo Alto Networks advisory for upgrade status) |
| Unsupported PAN-OS | Upgrade to a supported, fixed release |
Check the vendor advisory for the exact hotfix that matches your maintenance train. Palo Alto Networks notes that after some fixed releases, all GlobalProtect users have to sign in again.
What attackers are doing
Rapid7 first saw exploitation on 17 May 2026, days after the advisory came out. A second wave on 21 May established VPN tunnels into internal networks. At that stage Rapid7 saw no lateral movement.
Unit 42’s October update describes a more serious picture. Since early June, its incident responders have handled cases across education, financial services, healthcare, manufacturing, government, utilities, retail and other sectors. In those intrusions, attackers:
- used the flaw to get a VPN session and bypass MFA,
- ran internal reconnaissance with legitimate remote monitoring and management (RMM) tools,
- moved laterally over RDP and SMB,
- staged tools for credential theft and data exfiltration, then deployed ransomware.
The most worrying change is a direct move to the virtualisation layer. In one case, attackers went from the VPN gateway to the vCenter management appliance, turned off an ESXi security control (execInstalledOnly), and dumped domain credentials by reading a domain controller’s virtual disk offline. That route avoids endpoint detection and response (EDR) tools running inside the guest. Unit 42 also saw this access chained with an older Veeam Backup & Replication flaw, CVE-2023-27532, to reach backup infrastructure.
What to do
1. Find every GlobalProtect portal and gateway. Include Prisma Access tenants, lab and DR firewalls, and anything a third party manages for you.
2. Patch to a fixed release. Use the table above and the vendor advisory. Where patching has to wait, apply one of the vendor mitigations:
- turn off authentication override on both portal and gateway, or
- issue a new, dedicated certificate used only for authentication override cookies, and don’t reuse it anywhere else.
Either change removes the condition the attack depends on. A patched firewall still needs the hunting steps below, because patching does not undo earlier access.
3. Hunt in GlobalProtect logs back to mid-May. Unit 42 and Rapid7 suggest looking for:
- successful logins where the authentication method is Cookie, especially for local or admin accounts that don’t normally use the VPN,
- gateway-connected events with generic or placeholder host names and MAC addresses (both vendors list examples),
- sessions from low-cost hosting providers rather than your users’ usual ISPs,
- the source IP addresses published by Unit 42 and Rapid7.
Treat any successful match as an incident, not a false positive to close.
4. Look beyond the firewall. Because the reported attacks go straight for virtualisation and backups:
- review vCenter and ESXi logs for unexpected logins from VPN address pools, and check that
execInstalledOnlyis still enforced on every host, - check for new or unusual RMM tools on servers,
- confirm Veeam Backup & Replication is patched for CVE-2023-27532 and is not reachable from VPN user ranges,
- look for RDP and SMB sessions from VPN addresses to servers those users don’t normally touch.
5. Rotate and reset if you find anything. Revoke active VPN sessions, reset credentials for any account seen in suspicious cookie logins, and plan a domain-wide credential reset (including krbtgt) if a domain controller’s disk may have been read.
6. Reduce what’s exposed. Restrict the PAN-OS management interface to a dedicated admin network, keep local accounts off VPN authentication profiles where you can, and limit what VPN users can reach. Hypervisor and backup management interfaces should not be reachable from general VPN ranges.
How PoCForge can help
An external attack surface review will show which of your VPN gateways and portals are reachable and how they’re configured. An assumed-breach test that starts from a VPN session will show how far an attacker could get from there into vCenter, ESXi and backups. Both are worth doing while this campaign is active.
Sources
- Palo Alto Networks security advisory: CVE-2026-0257
- Unit 42 threat brief: Active Exploitation of PAN-OS CVE-2026-0257 (updated 19 October 2026)
- Rapid7: Observed exploitation of CVE-2026-0257
- CISA Known Exploited Vulnerabilities catalogue
- NVD: CVE-2026-0257
PoCForge publishes offensive-security research to explain attack paths and defensive controls. This article summarises public advisories only; it is not an exploit guide and does not describe a named client engagement.
