# PAN-OS GlobalProtect accepts forged authentication override cookies

Source: https://startwithidentity.com/cves/cve-2026-0257/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

GlobalProtect can issue an authentication override cookie so a user who has signed in once does not sign in again on every connection. Palo Alto Networks' advisory, published May 13, 2026, says PAN-OS relied on that cookie without validating its integrity (CWE-565), which let an attacker "bypass security restrictions and establish an unauthorized VPN connection." Only portals with "Generate cookie for authentication override" or "Accept cookie for authentication override" enabled, or gateways accepting the cookie, together with a specific certificate configuration, are exposed. Panorama and Cloud NGFW are not affected. Fixes ship in 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6 and in the hotfix builds the advisory lists. NVD scores it CVSS 3.1 9.1; the vendor's CVSS 4.0 score is 7.8.

CISA added it to KEV on May 29, 2026 and marks it as used in ransomware campaigns. Unit 42 reported in October 2026 that Qilin and INC operators used it to get a VPN session past MFA, then moved laterally over RDP and SMB. In one case they pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.

## Why it matters

The cookie stands in for the whole login. A gateway that accepts it skips the password, the IdP redirect and the MFA prompt, so a forgeable cookie means anyone can arrive as a connected user. MFA on the VPN does nothing once the step that checks it is optional. See the [breach database record](https://startwithidentity.com/breaches/incidents/2026-pan-os-globalprotect-auth-bypass-ransomware/) and our [October 2026 coverage](https://startwithidentity.com/blog/2026-10-19-qilin-and-inc-use-globalprotect-auth-bypass-to-skip-mfa-and-dump-dc-disks/).

## What to do

- Upgrade PAN-OS to a fixed build. Users re-authenticate once after the upgrade.
- Until then, use a dedicated certificate for authentication override cookies that is not shared with the portal, the gateway or any other feature, or turn authentication override off on both portal and gateway.
- Hunt GlobalProtect logs for gateway-connected events with placeholder host IDs or device names (Unit 42 lists `aa:bb:cc:dd:ee:ff`, `DESKTOP-GP01`, `GP-CLIENT`) and for sessions with an empty user domain.

## After you patch

- Treat any suspicious VPN session as a domain compromise: reset the `krbtgt` account twice, rotate privileged and service account passwords, and revoke VPN client certificates.
- Check vCenter and ESXi for configuration changes and virtual disk access from the VPN address pool.

## Sources

- [NVD: CVE-2026-0257](https://nvd.nist.gov/vuln/detail/cve-2026-0257)
- [Palo Alto Networks security advisory CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
- [Unit 42: Active exploitation of May 2026 PAN-OS CVE-2026-0257 (updated October 20, 2026)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/)
- [CISA Known Exploited Vulnerabilities catalog, added May 29, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257)