Critical and Already Being Exploited: PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)

A 9.1 critical authentication bypass in PAN-OS GlobalProtect, actively exploited and now in CISA KEV. But it only bites under a specific config. The two questions that decide your workload: is the product in your stack, and does your config meet the exposure conditions?

CVE-2026-0257 is a 9.1 critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect. It is being actively exploited in the wild, and it was added to the CISA KEV catalog on May 29. If you run affected PAN-OS or Prisma Access in an exposed configuration, this is a drop-everything item.

The score already tells you it is serious. The active exploitation and KEV listing remove any remaining doubt. So the useful question is not "how bad is it," it is "does it reach my environment, and under what conditions." That is where this one gets interesting.

What it is

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. A remote, unauthenticated attacker can bypass authentication and establish a VPN connection into the network. Panorama and Cloud NGFW are not affected.

The root cause is a trust problem. GlobalProtect has a feature called authentication override, which issues a cookie so a user does not have to re-enter credentials on every connection, similar to a bearer token. The appliance decrypts that cookie with a private key, but it never verifies a signature on the decrypted contents. So if an attacker can learn the public key tied to the certificate used for these cookies, they can forge a valid cookie for any user, including admin. The weakness class is CWE-565, reliance on cookies without integrity checking.

Does it actually affect you?

This is the part worth slowing down on, because the vulnerability only bites under a specific configuration. Two conditions both have to be true:

• Authentication override has to be enabled on your GlobalProtect portal or gateway. It is not on by default.
• The certificate used to encrypt and decrypt those override cookies has to be reused somewhere else, such as the portal or gateway's own HTTPS service. That reuse is what lets an attacker recover the public key remotely and forge cookies. If you use a dedicated certificate exclusively for authentication override, an attacker has no way to derive the key.

So this is not "every PAN-OS box is on fire." It is "PAN-OS boxes with override enabled and a reused certificate are exposed." That distinction is the difference between a fleet-wide panic and a targeted, measured response, and it is exactly the kind of detail a CVE ID alone will never tell you.

Why the urgency is real

Rapid7's MDR team observed successful exploitation across multiple customers starting May 17, with a second wave on May 21 that appears to be the same threat actor based on a consistent spoofed MAC address. A public proof-of-concept exists. The traffic originated from low-cost hosting providers, a common pattern for opportunistic campaigns scanning for exposed appliances. Edge VPN gear is precisely the kind of target where a single bypass turns into network access, which is what makes a critical-rated, actively exploited bypass like this so dangerous.

We've seen this shape before: PAN-OS shipped an unauthenticated root RCE last month (CVE-2026-0300). Perimeter appliances are a permanent, recurring attack surface, not a one-time deployment.

What to do

If you run an affected version, patch. Palo Alto has shipped fixes across the 10.2, 11.1, 11.2, and 12.1 trains, plus Prisma Access. The minimum fixed versions vary by branch, so check your exact build against the advisory rather than assuming.

If you cannot patch immediately, you have two mitigations:

• Disable authentication override entirely, or
• Generate a new certificate used only for authentication override cookies and stop sharing it with any other feature.

Note that after patching, GlobalProtect users will need to re-authenticate once, because the fix regenerates cookies using a more secure method.

The takeaway

A critical, actively exploited authentication bypass on an internet-facing VPN appliance is about as urgent as enterprise patching gets. But the noise around a CVE like this often drowns out the two questions that actually decide your workload: is the affected product in my stack, and does my configuration meet the exposure conditions. Answer those, and the priority sorts itself out.

That gap, between a CVE making headlines and what it actually means for your specific environment, is the problem worth solving. Track CVE-2026-0257 on VulnTracker — tell us what you run and you'd see this in your alerts within hours of disclosure, ranked above the less-urgent CVEs that landed the same day, with KEV/EPSS context to brief leadership.

Start a 5-day free trial, or get our daily digest free without setting anything up.

Quick reference

References: Palo Alto Networks security advisory · Rapid7 observed exploitation analysis

We hope your company is the one hackers skip.