Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) — CISA KEV-Listed, Confirmed Ransomware-Campaign Use, Federal Deadline Long Overdue

Executive Summary

An authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS (CVE-2026-0257) allows an attacker to bypass authentication and establish an unauthorized VPN connection when Authentication Override cookies are enabled with a specific certificate configuration. NVD rates this CVSS 9.1 (the vendor's own advisory self-rates it 7.8 — see Verified Facts for the discrepancy). EPSS places it in the 99.8th percentile of all scored vulnerabilities — meaning fewer than 2 in 1,000 scored CVEs are more likely to see real-world exploitation. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-29 with a federal remediation deadline of 2026-06-01 — now roughly eight weeks overdue as of this report's date. Palo Alto Networks' own advisory confirms limited in-the-wild exploitation against unpatched, unmitigated devices. CISA's KEV catalog separately flags this CVE with knownRansomwareCampaignUse: Known. Four PAN-OS release branches (10.2, 11.1, 11.2, 12.1) and two Prisma Access versions are affected; patches and two documented workarounds exist.

Executive Risk Snapshot

Why This Matters

Patch guidance for this CVE, read alone, misses half the exposure. Palo Alto Networks' advisory documents two independent remediation paths: apply the fix, or apply either of two workarounds (use a dedicated certificate for Authentication Override cookies, or disable Authentication Override entirely). [Analyst Assessment] (MEDIUM CONFIDENCE) — neither the vendor advisory nor CISA's KEV entry states whether patching alone retroactively terminates a VPN session or access grant that was already established via the authentication bypass before the patch was applied; architecturally, closing an authentication flaw does not itself revoke a session that flaw already created. An organization that patches today without also reviewing existing GlobalProtect sessions and access-control-list entries for anomalies predating the patch may be closing the door after already-established, unauthorized access remains inside it. This is an inference from how authentication-bypass classes of vulnerability generally behave, not a claim any cited source makes explicitly about this specific CVE — stated at MEDIUM CONFIDENCE for that reason.

Verified Facts — Vulnerability Fact Sheet

Technical Analysis

1. Precondition — the target GlobalProtect portal or gateway has Authentication Override cookies enabled, together with a specific certificate configuration named but not further detailed in the vendor's public advisory. [Verified Fact] (HIGH CONFIDENCE)
2. Exploitation — an attacker presents or manipulates the Authentication Override cookie mechanism such that the device trusts it without adequate validation (CWE-565: reliance on a cookie without validation and integrity checking), bypassing the authentication step the portal/gateway would otherwise require. [Verified Fact] (HIGH CONFIDENCE) — mechanism as described by the vendor; the exact byte-level or request-level exploitation detail has not been publicly disclosed by Palo Alto Networks, NVD, or CISA in sources available to this platform.
3. Result — the attacker establishes an unauthorized VPN connection through the gateway, gaining network access equivalent to a legitimate remote-access VPN session. [Verified Fact] (HIGH CONFIDENCE)
4. Scope boundary — Panorama and Cloud NGFW are explicitly not affected; this is scoped to PAN-OS GlobalProtect portal/gateway and the corresponding Prisma Access versions. [Verified Fact] (HIGH CONFIDENCE)
5. Post-access activity — no source available to this platform (NVD, CISA, or the vendor advisory) describes what an attacker did after establishing unauthorized VPN access in the observed exploitation attempts. [Intelligence Gap]

MITRE ATT&CK Mapping

No sub-technique specific to "authentication bypass via unvalidated cookie trust" was force-mapped. ATT&CK Enterprise does not have a clean, narrow technique for this exact mechanism the way it does for, say, credential dumping; T1556 (Modify Authentication Process) and T1550 (Use Alternate Authentication Material) were both considered and rejected — this platform's curated technique set does not currently include either, and forcing an uncurated ID onto a mechanism it does not precisely describe would repeat exactly the kind of imprecise mapping this platform's own quality gate exists to catch (see platform/open-issues.md Issue 3 and Issue 9 for two prior, real instances of this class of error found and fixed this session).

IOC Intelligence

No indicators of compromise (source IPs, target selection patterns, session artifacts, or any host/network indicator) have been publicly disclosed by NVD, CISA, or Palo Alto Networks as of this report. [Intelligence Gap] This is stated explicitly rather than populated with placeholder values. Organizations should prioritize the vendor's own patch/workaround guidance and GlobalProtect session review (below) over IOC blocklisting for this vulnerability, precisely because no blocklist-grade IOCs exist yet in public reporting available to this platform.

Behavioral Indicators & Detection Opportunities

• Review GlobalProtect portal/gateway configuration for whether Authentication Override is enabled and, if so, whether it uses a dedicated certificate — the vendor's own documented root cause and first workaround. [Verified Fact] (HIGH CONFIDENCE)
• Review existing GlobalProtect VPN sessions and access logs, focusing on sessions established without a corresponding interactive authentication event, for any period the device was running an affected, unpatched build. [Analyst Assessment] (MEDIUM CONFIDENCE) — an architecturally sound hunt given the vulnerability's described mechanism; no source confirms this exact log signature was observed in the reported exploitation attempts.
• Cross-reference GlobalProtect gateway public IP ranges against any organization-specific network monitoring for anomalous inbound connection patterns predating patch application.

Detection guidance (conceptual — PAN-OS log schema not independently verified)

No Sigma rule is provided for this report. The reason is stated explicitly rather than worked around with false precision: constructing a field-accurate Sigma rule requires the exact GlobalProtect/PAN-OS log field names for authentication-override-cookie events and VPN session establishment, and this platform did not independently confirm those field names against a live PAN-OS log export in the sources available for this report (NVD, CISA, and the vendor's own advisory text do not specify log schema). Publishing a Sigma rule with plausible-looking but unverified field names would present false technical precision — exactly the failure mode this platform's own quality gates and editorial standards exist to prevent (EIOS Layer 13; _gate_hype_language). The hunting guidance above describes the concept to search for; organizations should map it to their own confirmed PAN-OS/GlobalProtect log schema before building an automated rule.

Vulnerability Management Guidance

Patch prioritization: Emergency. KEV-listed status, a 99.8th-percentile EPSS score, and vendor-confirmed active exploitation together satisfy essentially any reasonable emergency-patch policy trigger, independent of which CVSS number (NVD's 9.1 or the vendor's own 7.8) an organization's policy keys off of. The federal remediation deadline (2026-06-01) is roughly eight weeks overdue as of this report's date — any organization still exposed should treat this as materially overdue, not merely "due soon."

If immediate patching is impossible: apply one of the vendor's two documented workarounds (dedicated certificate for Authentication Override cookies, or disabling Authentication Override) as an interim measure — these are vendor-published mitigations, not compensating controls this platform is inferring.

Regulatory Impact

US federal civilian executive branch agencies were required to remediate under the applicable CISA Binding Operational Directive by 2026-06-01 (already roughly eight weeks past as of this report's date). Non-federal organizations are not legally bound by that directive but should treat the KEV listing as an industry benchmark for reasonable patch timelines in any incident, audit, or regulatory inquiry.

Intelligence Gaps

• No specific ransomware family has been confirmed by an authoritative source available to this platform. This platform's own automated intelligence-aggregation pipeline surfaced a headline naming "Qilin" ransomware in connection with this CVE, but that item carries no supporting reference URL and no description in the pipeline's own captured data (api/intel/live.json, entry CVE-2026-0257) — this platform could not independently locate or verify a source for the specific Qilin attribution. [Unresolved Reference — verify before next revision] CISA's KEV catalog does independently confirm knownRansomwareCampaignUse: Known for this CVE without naming a specific group, which is the authoritative fact this report relies on instead.
• No indicators of compromise have been publicly disclosed by any source available to this platform.
• No specific victim organizations or sectors have been named.
• No post-exploitation activity (what an attacker did after establishing unauthorized VPN access) has been disclosed.
• The exact certificate-configuration precondition and the precise cookie-validation flaw are described only at a summary level by the vendor; no deeper technical write-up was located in sources available to this platform.

Confidence Assessment

References

1. CVE-2026-0257 (live JSON record, queried at report generation time). NVD REST API. https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-0257
2. CVE-2026-0257. National Vulnerability Database. https://nvd.nist.gov/vuln/detail/CVE-2026-0257
3. EPSS score (live query at report generation time). FIRST.org. https://api.first.org/data/v1/epss?cve=CVE-2026-0257
4. CISA Known Exploited Vulnerabilities Catalog (live feed, queried at report generation time). https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
5. Palo Alto Networks Security Advisory CVE-2026-0257 (live-fetched at report generation time). https://security.paloaltonetworks.com/CVE-2026-0257

Sentinel APEX Analyst Conclusion

CVE-2026-0257 is KEV-listed, EPSS-ranked in the top 0.2% of all scored vulnerabilities, vendor-confirmed under active exploitation, and roughly eight weeks past its federal remediation deadline as of this report — a combination of signals that independently justify emergency treatment without needing a specific ransomware family name attached to it. The platform's own aggregation pipeline surfaced a "Qilin ransomware" headline for this CVE with no locatable supporting source; this report deliberately does not repeat that claim as fact, and flags it instead as an unresolved reference pending verification, consistent with this platform's own reference-completeness standard (EIOS Layer 13; GIAAP v1). Enterprises running affected PAN-OS or Prisma Access builds should patch or apply one of the vendor's two documented workarounds immediately, and should review existing GlobalProtect sessions for anomalies predating remediation rather than treating a clean patch alone as proof no unauthorized access remains.

CyberDudeBivash® Sentinel APEX — Threat Intelligence Division