# Active Exploitation of Palo Alto GlobalProtect VPN Authentication Bypass Puts Enterprise Networks at Risk
## The Threat
Palo Alto Networks is urging customers to immediately patch a critical authentication bypass vulnerability in its PAN-OS GlobalProtect VPN platform as hackers actively exploit the flaw to breach corporate networks. Tracked as CVE-2026-0257, the vulnerability allows unauthenticated attackers to establish unauthorized VPN connections to affected devices—potentially granting access to protected internal networks without knowing valid credentials.
The flaw resides in how GlobalProtect portals and gateways validate authentication override cookies. Rather than cryptographically verifying these sensitive tokens, the vulnerable code merely decrypts them using a configured private key and blindly trusts the decrypted contents. Attackers can exploit this validation gap by obtaining the device's public certificate (often exposed via HTTPS) and using it to forge valid authentication cookies for any user account, including administrator accounts. This transforms a theoretical vulnerability into a direct pathway for unauthorized network access.
What makes this threat particularly concerning is the real-world exploitation activity. Threat actors began attacking unpatched devices on May 17, 2026, initially from Vultr-hosted infrastructure and later from Dromatics Systems. According to Rapid7's investigation, attackers successfully authenticated to GlobalProtect gateways in multiple customer environments and in some cases established full VPN sessions. While Rapid7 reports no confirmed lateral movement from the initial gateway compromise, the ability to establish authenticated VPN access represents a severe compromise of network perimeter security.
## Severity and Impact
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-0257 |
| CVSS Score | 6.5 (Medium) — upgraded to High after active exploitation |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Authentication | Not required (if override cookies enabled) |
| CWE | CWE-347: Improper Verification of Cryptographic Signature |
| CVSS Severity Rating | High (post-exploitation advisory update) |
The vulnerability's impact depends on device configuration. Organizations with GlobalProtect authentication override cookies enabled and certificate reuse across HTTPS and authentication functions face immediate risk. However, even organizations without these specific configurations should assess their deployments, as misconfigurations are common in mature environments.
## Affected Products
Palo Alto Networks PAN-OS:
Impacted Device Models:
Organizations running any GlobalProtect-enabled PAN-OS deployment should verify their current version and configuration status immediately.
## Mitigations
Immediate Actions (Critical Priority):
Temporary Workarounds (if patching is delayed):
Detection and Response:
Compliance Obligations:
Federal agencies and organizations working with CISA-regulated sectors must remediate by June 1, 2026, as the vulnerability was added to CISA's Known Exploited Vulnerability (KEV) catalog on May 29, 2026.
## References
---
## HackWire Analysis
CVE-2026-0257 represents a pivotal moment in VPN security — the transition from theoretical vulnerability to weaponized exploit. What's striking isn't the technical elegance of the attack, but its brutal simplicity: attackers don't need to guess passwords, crack hashes, or social-engineer users. They extract a publicly visible certificate and manufacture legitimate-looking credentials. The flaw exposes a fundamental truth many security teams ignore: authentication override features are often footguns disguised as convenience.
The configuration dependency is the real story here. Palo Alto designed authentication override cookies for specific use cases — typically administrative break-glass access or headless integrations. Most organizations don't need them enabled. Yet Rapid7's observations suggest the feature remains active in numerous production environments, many of which may not realize it. This is the classic enterprise security pattern: security features deployed years ago during initial setup, their necessity never re-evaluated, their risks never reassessed. Authentication override cookies made sense in 2018. In 2026, with modern identity management, they're often legacy cruft — and now they're weaponized cruft.
The geographic pattern of attacks is worth monitoring. Early waves from Vultr (May 17) suggest reconnaissance or initial access brokers testing the vulnerability. The Dromatics Systems infrastructure (May 21) may indicate operational escalation — different threat actors, different objectives, or the same campaign widening its scope. Rapid7's finding that many devices accepted forged cookies but couldn't establish full VPN sessions is also revealing: it suggests attackers are mapping the vulnerability's actual exploitation chain in the wild, discovering that technical barriers prevent some attacks from fully succeeding. This will drive incremental refinement of their approach.
For defenders, the June 1 CISA deadline for federal agencies is a forcing function that will trickle down. Contractors, healthcare providers, and critical infrastructure operators will face compliance questions from their government customers. Insurance carriers will begin asking for patch status. The advisory update from Medium to High severity signals that Palo Alto took this seriously enough to revise their own assessment after active exploitation — organizations should treat that signal as a wake-up call. This is not a theoretical vulnerability to patch in your next maintenance window. This is active-threat-in-the-wild territory.
— HackWire Editorial
## Related Coverage