PAN-OS GlobalProtect CVE-2026-0257: The Cookie That Is Not Verified

After SonicWall, Check Point, and SimpleHelp, a new remote access device vulnerability confirms the underlying trend of 2026: the network edge is the battlefield. CVE-2026-0257 affects Palo Alto Networks PAN-OS and Prisma Access, in their GlobalProtect component. Its trajectory is instructive on how a flaw can be underestimated before becoming a priority.

Palo Alto published an advisory on May 13, 2026, initially rating it medium severity with a CVSS score of 4.7. After Rapid7 published a technical analysis and a working exploit on May 29, 2026, the vendor revised the score upward to 7.8. The same day, CISA added it to its Known Exploited Vulnerabilities catalog. The lesson is clear: a moderate initial score is no guarantee, and the publication of an exploit can turn a secondary flaw into an emergency.

The mechanism: excessive trust in a cookie

CVE-2026-0257 is an authentication bypass that lets an attacker establish an unauthorized VPN connection. The root cause is that firewalls rely on cookies without performing detailed validation or integrity checking. The flaw affects configurations where a GlobalProtect portal or gateway has the authentication override feature enabled, combined with a specific certificate configuration.

This is T1190 (Exploit Public-Facing Application), resulting in use of a remote access service, T1133 (External Remote Services). Rapid7 observed a second exploitation wave on May 21 and, based on consistent MAC addresses, believes both waves likely come from the same actor. In early June, Arctic Wolf saw an increase in active exploitation.

Check your exposure with Nuclei

The priority is to know which GlobalProtect portals in your estate are reachable and potentially in the vulnerable configuration. A Nuclei template lets you identify an exposed GlobalProtect portal, the first step before checking the authentication override configuration on the admin side.

id: paloalto-globalprotect-portal
info:
  name: Exposed Palo Alto GlobalProtect portal
  author: threatclaw
  severity: info
  description: Spots a reachable GlobalProtect portal, to audit for CVE-2026-0257
  reference:
    - https://security.paloaltonetworks.com/CVE-2026-0257
  tags: paloalto,globalprotect,vpn,cve-2026-0257,kev
http:
  - method: GET
    path:
      - "{{BaseURL}}/global-protect/login.esp"
      - "{{BaseURL}}/global-protect/portal/css/login.css"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "GlobalProtect Portal"
          - "global-protect"
        condition: or
      - type: status
        status:
          - 200

This template is for discovery: it lists exposed portals. Then cross-check against the authentication override configuration, since that is what makes the instance vulnerable. Complement network monitoring with a Suricata rule on GlobalProtect connection attempts presenting an override cookie without a matching prior authentication session.

The mitigation, immediate and without a patch

A reassuring point: the mitigation does not necessarily depend on a software patch. Palo Alto recommends two options. Either disable the authentication override feature, if it is not essential to your deployment. Or generate a new certificate dedicated exclusively to this override feature, which restores the integrity the flaw bypassed. This second option preserves functionality while closing the gap.

Also check logs for GlobalProtect sessions established without matching authentication before the mitigation, because a connection opened via this bypass could have served as an entry point into the network.

Detecting exploitation — patching doesn't undo what already happened

If your portal was internet-reachable and misconfigured before you read this, patching today closes the door but does not evict anyone who already walked through it. That is the part detection has to cover: was CVE-2026-0257 used against you, and is a forged session live right now?

The signal is specific: a GlobalProtect VPN session authenticated via the override cookie for a privileged account, with no preceding successful interactive authentication or MFA event for that user in the same window. A legitimate override-cookie session always has a real login further back in the chain; a forged one does not — the cookie is the only "authentication" that ever happened. Rapid7's incident data adds a weaker second signal worth watching alongside it: source IPs from hosting/VPS providers rather than the ranges your remote workforce normally connects from (Vultr, in the cases they observed) — useful as enrichment, not a durable indicator, since attacker infrastructure rotates.

title: GlobalProtect Cookie Authentication to Privileged Account (CVE-2026-0257)
id: 9d3a7e21-5c88-4f0a-9e6b-1a2f7c4d8b3e
status: experimental
description: >
  Detects GlobalProtect VPN authentication events for privileged or service
  accounts where the session was established via the authentication override
  cookie rather than an interactive login. Legitimate override-cookie use always
  has a prior successful interactive/MFA authentication for the same user; a
  session with no such prior event is consistent with a forged cookie
  (CVE-2026-0257). Field names follow common PAN-OS GlobalProtect log exports
  (Syslog/Panorama) — map them to your SIEM's actual connector fields.
logsource:
  category: vpn
  product: paloalto_networks
detection:
  selection_cookie_auth:
    AuthMethod|contains:
      - 'Cookie'
      - 'auth-override'
  selection_privileged_account:
    User|contains:
      - 'admin'
      - 'administrator'
      - 'svc-'
      - 'service-'
      - 'root'
  condition: selection_cookie_auth and selection_privileged_account
falsepositives:
  - Environments where authentication override cookies remain enabled for admin
    or service accounts by design (disabling override for those accounts is itself
    a recommended mitigating control)
  - Cookie renewal for a legitimately re-authenticated privileged session, if your
    log source does not chain the renewal back to the original login
level: high
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1133
  - attack.t1078
  - cve.2026.0257

Two things make this rule stronger in practice. First, pair it with a correlation check in your SIEM: for every match, look back N minutes for an interactive, SAML, or LDAP authentication for the same user — its absence is the actual confirmation, and the Sigma rule alone is a prioritized hunt lead, not a guaranteed positive. Second, treat any hit as an incident, not an alert to triage next week: pull the session's subsequent internal activity immediately, because the confirmed cases so far moved from forged cookie to ransomware deployment in the same engagement.

FAQ

Am I affected by CVE-2026-0257? You're in the vulnerable configuration if you run a GlobalProtect portal or gateway with authentication override cookies enabled and the certificate used to encrypt those cookies is shared with the portal/gateway's HTTPS service rather than dedicated to the override feature. Check the exact affected PAN-OS and Prisma Access version ranges on the vendor advisory — they've been revised more than once since May 2026. Confirming whether your portal is even internet-reachable, with a check like the Nuclei template above, is a fast first step.

How do I detect if CVE-2026-0257 has already been exploited against us? Look for GlobalProtect VPN sessions authenticated via the override cookie for privileged or service accounts with no preceding interactive or MFA authentication event — that gap is the signature of a forged cookie. The Sigma rule above is a starting point; also check for admin logins from unfamiliar geographies or hosting-provider IP ranges, and audit any activity that followed a suspicious session.

Is patching enough? No — patching (or applying the certificate/override workaround) stops future exploitation but does not retroactively revoke access an attacker already gained through a forged cookie before you closed the hole. Treat patching as step one and run the detection checks above as step two, specifically to answer whether you were hit during the exposure window.

Is CVE-2026-0257 in the CISA KEV catalog? Yes. CISA added it on May 29, 2026, the same day Palo Alto revised the CVSS score from 4.7 to 7.8 following Rapid7's proof-of-concept. Check the CISA KEV catalog directly for the current remediation deadline that applies to your organization.

The through-line of summer 2026

This vulnerability is not an isolated case but a link in a series. SonicWall, Check Point, SimpleHelp, Palo Alto: edge and remote access devices concentrate the most exploited vulnerabilities of the season, which the DBIR 2026 report confirms statistically. The rational posture is to treat any exposed VPN portal as a priority target, to track the KEV catalog continuously, and to have up-to-date scan templates to verify your exposure within minutes.

That is precisely what the ThreatClaw Nuclei feed provides: detection templates refreshed at the pace of disclosures and prioritized on real exploitation, to identify without delay what in your exposed surface demands action.