# Palo Alto GlobalProtect Auth Bypass Under Active Exploit: Defenders Must Patch Immediately
## The Threat
Attackers are actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN technology that allows them to gain VPN access without valid credentials. The flaw, tracked as CVE-2026-0257, was disclosed and patched by Palo Alto Networks in May 2026, but has since become the target of two separate attack waves beginning mid-May that have successfully compromised unpatched firewalls across multiple organizations.
The vulnerability resides in the GlobalProtect portal and gateway components of PAN-OS, which are commonly deployed as the primary edge security appliance for remote access in enterprise networks. Despite receiving an initial CVSS severity score of 7.8 (medium), security researchers at Rapid7 are urging organizations to treat this flaw as a critical priority given the nature of the vulnerability and the fact that it is already being weaponized in the wild. The risk is particularly acute because VPN appliances operate at the network perimeter—compromising one grants attackers direct access to internal corporate infrastructure.
Palo Alto Networks updated its advisory on May 28, 2026, confirming that there have been "limited exploit attempts on unpatched PAN-OS devices without mitigations applied." The warning came after Rapid7 identified successful exploitation across numerous customer environments and after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) formally added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 29. The exploitation method is straightforward: attackers use forged authentication cookies to bypass the VPN's authentication controls and impersonate legitimate users.
## Severity and Impact
| Attribute | Details |
|-----------|---------|
| CVE Identifier | CVE-2026-0257 |
| CVSS Score | 7.8 (Medium) |
| CVSS Vector | Network / Low Complexity / No Authentication |
| CWE | CWE-287 (Improper Authentication) |
| Attack Vector | Network |
| Attack Complexity | Low (with prerequisites) |
| Authentication Required | No |
| User Interaction | None |
| Impact | Confidentiality & Integrity Compromise |
| Active Exploitation | Yes (as of May 17, 2026) |
| In CISA KEV Catalog | Yes (added May 29, 2026) |
## Affected Products
Palo Alto Networks PAN-OS (all versions with GlobalProtect portal or gateway enabled):
Affected Components:
Organizations using these versions are at risk if their deployments include authentication override cookies enabled and specific certificate configurations. Palo Alto Networks has released patched versions addressing the vulnerability—check your specific PAN-OS version against the official advisory for the corresponding patch version.
## Mitigations
Immediate Actions:
1. Apply Vendor Patches: Update PAN-OS to the patched versions provided by Palo Alto Networks without delay. This is the definitive remediation and should be treated as a critical priority.
2. Disable Authentication Override Cookies: If immediate patching is not possible, disable authentication override cookie functionality in GlobalProtect portal and gateway configurations. This eliminates one of the prerequisites for exploitation, though it may impact user experience.
3. Network Segmentation: Restrict VPN access at the network level using firewall rules and access control lists. Segment VPN user traffic from sensitive internal systems to limit lateral movement if a VPN session is compromised.
4. Monitor Authentication Logs: Implement robust logging and alerting on GlobalProtect authentication events. Look for anomalous authentication patterns, failed login attempts followed by successful access, or authentication from unusual geographic locations.
5. Implement Multi-Factor Authentication (MFA): Enforce MFA for all VPN access, including hardware tokens or authenticator apps, to add a second layer of protection against credential compromise or bypass attempts.
6. Review Certificate Configurations: Audit the certificate configurations on GlobalProtect portals and gateways to identify those matching the vulnerable configurations described in the advisory.
## References
## HackWire Analysis
The CVSS score of 7.8 does not reflect the true operational risk of this vulnerability. While the score technically qualifies as "medium" severity, the prerequisites—authentication override cookies enabled and a specific certificate configuration—are common in production deployments designed for user convenience and operational continuity. This creates a dangerous mismatch between the numerical rating and real-world exploitability. Rapid7's decision to treat this as a critical issue is correct and reflects what defenders already know: a VPN authentication bypass is functionally equivalent to a critical vulnerability, regardless of how many checkboxes had to be ticked to trigger it.
The timing is also significant. Palo Alto Networks has faced multiple high-profile vulnerabilities in recent quarters, creating a pattern of patching cycles that some organizations may struggle to keep pace with. The fact that exploitation began within weeks of disclosure—and across "numerous customers"—suggests that attackers are either reverse-engineering patches quickly or have access to detailed exploit code. CISA's rapid addition to the KEV catalog indicates that the federal government is taking this threat seriously, and all federal contractors and critical infrastructure operators must now treat this as a compliance mandate.
What makes this particularly dangerous is that VPN appliances are meant to be the trust boundary. They sit at the network edge and decide who gets in. When that boundary is breached—especially when it can be breached without valid credentials—attackers gain direct access to internal networks, potentially bypassing multiple layers of downstream security controls. While Rapid7 noted that they "did not observe any indication of successful lateral movement," that absence of evidence may simply reflect either the recency of the attacks or attackers playing a patient long game, establishing persistence before moving laterally. Organizations should assume that any unpatched VPN has been compromised and should treat forensics accordingly.
— HackWire Editorial
## Related Coverage