CVE-2026-0257PAN-OS GlobalProtect accepts forged authentication override cookies
What broke
GlobalProtect can issue an authentication override cookie so a user who has signed in once does not sign in again on every connection. Palo Alto Networks' advisory, published May 13, 2026, says PAN-OS relied on that cookie without validating its integrity (CWE-565), which let an attacker "bypass security restrictions and establish an unauthorized VPN connection." Only portals with "Generate cookie for authentication override" or "Accept cookie for authentication override" enabled, or gateways accepting the cookie, together with a specific certificate configuration, are exposed. Panorama and Cloud NGFW are not affected. Fixes ship in 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6 and in the hotfix builds the advisory lists. NVD scores it CVSS 3.1 9.1; the vendor's CVSS 4.0 score is 7.8.
CISA added it to KEV on May 29, 2026 and marks it as used in ransomware campaigns. Unit 42 reported in October 2026 that Qilin and INC operators used it to get a VPN session past MFA, then moved laterally over RDP and SMB. In one case they pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.
Why it matters
The cookie stands in for the whole login. A gateway that accepts it skips the password, the IdP redirect and the MFA prompt, so a forgeable cookie means anyone can arrive as a connected user. MFA on the VPN does nothing once the step that checks it is optional. See the breach database record and our October 2026 coverage.
What to do
- Upgrade PAN-OS to a fixed build. Users re-authenticate once after the upgrade.
- Until then, use a dedicated certificate for authentication override cookies that is not shared with the portal, the gateway or any other feature, or turn authentication override off on both portal and gateway.
- Hunt GlobalProtect logs for gateway-connected events with placeholder host IDs or device names (Unit 42 lists
aa:bb:cc:dd:ee:ff,DESKTOP-GP01,GP-CLIENT) and for sessions with an empty user domain.
After you patch
- Treat any suspicious VPN session as a domain compromise: reset the
krbtgtaccount twice, rotate privileged and service account passwords, and revoke VPN client certificates. - Check vCenter and ESXi for configuration changes and virtual disk access from the VPN address pool.
Sources
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- k0t access broker breaks into edge devices and harvests directory credentials 2026 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
Related on Start with Identity
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C