The business logic of the attack: why bypass authentication GlobalProtect needs an attacker
GlobalProtect is a VPN solution of Palo Alto Networks built into PAN-OS. On the perimeter of enterprise networks, this is the entry point for remote employees, and for the attacker - an initial source without a single password. Without MFA. Without credential stuffing. Without phishing
According to CrowdStrike Global Threat Report 2025, a significant proportion of incursions use valid accounts. From the point of view of SIEM, it is a valid login with valid cookie. According to Verizon DBIR 2025, a significant part of the leaks is associated with the theft of credentials. There is nothing to steal here, because credentials is not needed.
In terms of MITRE ATT&CK, the chain looks like: Exploit Public-Facting Application (T1190, Initial Access) - the forgery of the cookie gives the initial access through the perimeter device. Through the VPN tunnel, the attacker receives Valid Accounts (T1078, Defense Evasion / Persistence / Privelge Escalation / Initial Access) and External Remote Services (T1133, Initial Access / Persistence) Legitimate Network Access to Internal Infrastructure. After installing a VPN tunnel, further actions are standard post-exploitation: lateral movement, credential abuse. But this is already outside the framework of itself CVE-2026-0257.
Anatomy Palo Alto Networks Vulnerability: CWE-565 and lack of cookie verification
How authentication override cookies work in PAN-OS
GlobalProtect has the "authentication override" function - the portal or gateway gives the authenticated user an encrypted cookie so that the next connection does not enter the password again. In fact - bearer token: present cookies, get access.
According to available publications, the cookie contains a username, domain, host ID, version of the customer OS, the remote address and timestamp (cookie has the finite lifetime). Everything is encrypted with the public key of the certificate assigned to auth override; the decryption is performed by a private key on the gateway side.
The processing is implemented in the GlobalProtect service. Below are the conditional names of functions illustrating logic (the exact structure of the binary and the names of the characters depend on the PAN-OS version):
• Login processing - at POST-request for /ssl-vpn/login.espchecked for HTTP parameter portal-userauthcookieor portal-prelogonuserauthcookie. If there is a parameter - the management goes into the logic of cookie-authentication.
• Cookie-autification - accepts encrypted cookies, decrypts, then uses the extracted data (username, domain, timestamp) for authorization.
• Choice decryption - decodes the cookie from base64, decrypts the private key. After decryption, the content is entrusted implicitly: no signature check, HMAC or integrity check is not performed.
This is where the dog is buried. CWE-565 - Reliance on Cookies without Validation and Integrity Checking. The system relies on the fact that if the cookie was deciphered, it means that it is legitimate. Classic CAPEC-114 (Authentication Abuse)
Reuse of the certificate - the root VPN bypass
The problem becomes in operation under a specific condition: the certificate for encryption auth override cookies coincides with the HTTPS service of the portal or the GlobalProtect gateway.
Why it is critical: the public key of the HTTPS certificate is available to anyone who connects to the portal. The attacker pulls it standard openssl s_client -connect target:443, receives a public key and encodes them with a fake cookie with arbitrary username - including admin. The server decrypts cookies with a private key, sees valid floors, does not check the integrity - and authorizes the session.
When the technique works:
• GlobalProtect portal or gateway included
• Authentication override cookies enabled (NON defaulting setup)
• The auth override certificate coincides with the HTTPS certificate of the portal/gate
• Cloud Authentication Service (CAS) is disconnected
When the technique is NOT working:
• Auth override cookies are disabled (default)
• Dedicated certificate for auth override (does not match the HTTPS service)
• CAS is included (for this scenario there is a separate CVE-2026-0265, CWE-347, other vector)
• Cloud NGFW and Panorama not affected
• Patched versions of PAN-OS
[Applicable to: external pentest, GlobalProtect portal/gateway is available from the Internet, PAN-OS 10.2.x-12.1.x to fixes]
CVSS escalation: why the critical vulnerability of the VPN 2026 first got a medium
Current vector (CVSSv4): AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V
/RE:M/U:Red
What do the key components mean:
• AV:N, AC:L, PR:N, UI:N - network attack, low complexity, no privileges, no user actions. The ideal vector for mass exploitation.
• VC:L is a low impact on the privacy of a vulnerable system (firewall itself). It was this component that underestimated the assessment.
• SC:H, SI:H is a high impact on the confidentiality and integrity of subsequent systems. Through a VPN tunnel, the attacker hits the internal network - and this is a completely different scale.
Presumably, the original CVSS-BT was below the final 7.8, as it was calculated without confirmation of active operation (E: not Active). The specific initial value is not confirmed by the official source. Palo Alto Networks in the FAQ explained: “The overall severity is tied to Threat Score, which is dynamically adjusted based on threat intelligence. Score grows when PoC is published or active attacks are observed.”
On May 29, several things happened at once: PoC was published, active operation has been confirmed since May 17, CISA added CVE to the KEV with a deadline of June 1 - three days for fixation for federal agencies. CVSS-BT reached 7.8, E was replaced by A (Active), U (Urgent) became Red. Public recommendations explicitly stated "treat this as a critical vulnerability""Take it a critical vulnerability" - formally high, in fact, criticism in each report.
EPSS at the time of writing - 0.8668, %erile 99.71%. CVE-2026-0257 has a higher operating probability than 99.71% of all CVE in the FIRST.org database. CISA SSVC decision - Act (Patch Immediately), Technical Impact - total.
Recon: fingerprinting of vulnerable GlobalProtect-insins
Adjustments to the environment:
• OS: Kali Linux 2024.x or any GNU/Linux system with Python 3.9+
• Tools: openssl(1.1+), curl, nmap
• Network: HTTPS-access (443/tcp) to the target GlobalProtect portal/gateway
• Laboratory environment: EVE-NG with PAN-OS 10.2.8 image for safe testing (RAM: 8 GB minimum for VM with PAN-OS, 16 GB recommended)
The first step is to make sure that you have a GlobalProtect, not another VPN. Usually enough GET-request for the root of the HTTPS service: the answer will be characteristic headings and redirect to /global-protect/login.esp or /ssl-vpn/login.esp.
Check the configuration of auth override cookies from the outside is not directly - this is internal setting. But you can check the certificate: if the same certificate is used for an HTTPS service and for auth override, this can be seen by the serial number in TLS-handshake.
Bash:
openssl s_client -connect target.example.com:443 -showcerts \
</dev/null 2>/dev/null | openssl x509 -noout -serial -subject
The serial number and subject certificate are the first marker. If GlobalProtect uses a default self-signed certificate or certificate with generic subject, the probability of matching with the auth override cert above.
For automation there is a Nuclei-temper CVE-2026-0257.yaml (The way: javascript/cves/2026/CVE-2026-0257.yaml in the repository of projectdiscovery/nuclei-templates). Launch: nuclei -t CVE-2026-0257.yaml -u https://target.example.com. The template checks the presence of a vulnerable configuration through a specific request to endpoint in authentication.
On GitHub there is a public PoC-repository (akashsingh0454/CVE-2026-0257-PoC(GitHub - akashasingh0454/CVE-2026-0257-PoC), 2 stars, updated June 3, 2026). Two stars and no audit - before use, the code should be subtracted by hands.
GlobalProtect is a VPN solution of Palo Alto Networks built into PAN-OS. On the perimeter of enterprise networks, this is the entry point for remote employees, and for the attacker - an initial source without a single password. Without MFA. Without credential stuffing. Without phishing
According to CrowdStrike Global Threat Report 2025, a significant proportion of incursions use valid accounts. From the point of view of SIEM, it is a valid login with valid cookie. According to Verizon DBIR 2025, a significant part of the leaks is associated with the theft of credentials. There is nothing to steal here, because credentials is not needed.
In terms of MITRE ATT&CK, the chain looks like: Exploit Public-Facting Application (T1190, Initial Access) - the forgery of the cookie gives the initial access through the perimeter device. Through the VPN tunnel, the attacker receives Valid Accounts (T1078, Defense Evasion / Persistence / Privelge Escalation / Initial Access) and External Remote Services (T1133, Initial Access / Persistence) Legitimate Network Access to Internal Infrastructure. After installing a VPN tunnel, further actions are standard post-exploitation: lateral movement, credential abuse. But this is already outside the framework of itself CVE-2026-0257.
Anatomy Palo Alto Networks Vulnerability: CWE-565 and lack of cookie verification
How authentication override cookies work in PAN-OS
GlobalProtect has the "authentication override" function - the portal or gateway gives the authenticated user an encrypted cookie so that the next connection does not enter the password again. In fact - bearer token: present cookies, get access.
According to available publications, the cookie contains a username, domain, host ID, version of the customer OS, the remote address and timestamp (cookie has the finite lifetime). Everything is encrypted with the public key of the certificate assigned to auth override; the decryption is performed by a private key on the gateway side.
The processing is implemented in the GlobalProtect service. Below are the conditional names of functions illustrating logic (the exact structure of the binary and the names of the characters depend on the PAN-OS version):
• Login processing - at POST-request for /ssl-vpn/login.espchecked for HTTP parameter portal-userauthcookieor portal-prelogonuserauthcookie. If there is a parameter - the management goes into the logic of cookie-authentication.
• Cookie-autification - accepts encrypted cookies, decrypts, then uses the extracted data (username, domain, timestamp) for authorization.
• Choice decryption - decodes the cookie from base64, decrypts the private key. After decryption, the content is entrusted implicitly: no signature check, HMAC or integrity check is not performed.
This is where the dog is buried. CWE-565 - Reliance on Cookies without Validation and Integrity Checking. The system relies on the fact that if the cookie was deciphered, it means that it is legitimate. Classic CAPEC-114 (Authentication Abuse)
Reuse of the certificate - the root VPN bypass
The problem becomes in operation under a specific condition: the certificate for encryption auth override cookies coincides with the HTTPS service of the portal or the GlobalProtect gateway.
Why it is critical: the public key of the HTTPS certificate is available to anyone who connects to the portal. The attacker pulls it standard openssl s_client -connect target:443, receives a public key and encodes them with a fake cookie with arbitrary username - including admin. The server decrypts cookies with a private key, sees valid floors, does not check the integrity - and authorizes the session.
When the technique works:
• GlobalProtect portal or gateway included
• Authentication override cookies enabled (NON defaulting setup)
• The auth override certificate coincides with the HTTPS certificate of the portal/gate
• Cloud Authentication Service (CAS) is disconnected
When the technique is NOT working:
• Auth override cookies are disabled (default)
• Dedicated certificate for auth override (does not match the HTTPS service)
• CAS is included (for this scenario there is a separate CVE-2026-0265, CWE-347, other vector)
• Cloud NGFW and Panorama not affected
• Patched versions of PAN-OS
[Applicable to: external pentest, GlobalProtect portal/gateway is available from the Internet, PAN-OS 10.2.x-12.1.x to fixes]
CVSS escalation: why the critical vulnerability of the VPN 2026 first got a medium
Current vector (CVSSv4): AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V
/RE:M/U:RedWhat do the key components mean:
• AV:N, AC:L, PR:N, UI:N - network attack, low complexity, no privileges, no user actions. The ideal vector for mass exploitation.
• VC:L is a low impact on the privacy of a vulnerable system (firewall itself). It was this component that underestimated the assessment.
• SC:H, SI:H is a high impact on the confidentiality and integrity of subsequent systems. Through a VPN tunnel, the attacker hits the internal network - and this is a completely different scale.
Presumably, the original CVSS-BT was below the final 7.8, as it was calculated without confirmation of active operation (E: not Active). The specific initial value is not confirmed by the official source. Palo Alto Networks in the FAQ explained: “The overall severity is tied to Threat Score, which is dynamically adjusted based on threat intelligence. Score grows when PoC is published or active attacks are observed.”
On May 29, several things happened at once: PoC was published, active operation has been confirmed since May 17, CISA added CVE to the KEV with a deadline of June 1 - three days for fixation for federal agencies. CVSS-BT reached 7.8, E was replaced by A (Active), U (Urgent) became Red. Public recommendations explicitly stated "treat this as a critical vulnerability""Take it a critical vulnerability" - formally high, in fact, criticism in each report.
EPSS at the time of writing - 0.8668, %erile 99.71%. CVE-2026-0257 has a higher operating probability than 99.71% of all CVE in the FIRST.org database. CISA SSVC decision - Act (Patch Immediately), Technical Impact - total.
Recon: fingerprinting of vulnerable GlobalProtect-insins
Adjustments to the environment:
• OS: Kali Linux 2024.x or any GNU/Linux system with Python 3.9+
• Tools: openssl(1.1+), curl, nmap
• Network: HTTPS-access (443/tcp) to the target GlobalProtect portal/gateway
• Laboratory environment: EVE-NG with PAN-OS 10.2.8 image for safe testing (RAM: 8 GB minimum for VM with PAN-OS, 16 GB recommended)
The first step is to make sure that you have a GlobalProtect, not another VPN. Usually enough GET-request for the root of the HTTPS service: the answer will be characteristic headings and redirect to /global-protect/login.esp or /ssl-vpn/login.esp.
Check the configuration of auth override cookies from the outside is not directly - this is internal setting. But you can check the certificate: if the same certificate is used for an HTTPS service and for auth override, this can be seen by the serial number in TLS-handshake.
Bash:
openssl s_client -connect target.example.com:443 -showcerts \
</dev/null 2>/dev/null | openssl x509 -noout -serial -subject
The serial number and subject certificate are the first marker. If GlobalProtect uses a default self-signed certificate or certificate with generic subject, the probability of matching with the auth override cert above.
For automation there is a Nuclei-temper CVE-2026-0257.yaml (The way: javascript/cves/2026/CVE-2026-0257.yaml in the repository of projectdiscovery/nuclei-templates). Launch: nuclei -t CVE-2026-0257.yaml -u https://target.example.com. The template checks the presence of a vulnerable configuration through a specific request to endpoint in authentication.
On GitHub there is a public PoC-repository (akashsingh0454/CVE-2026-0257-PoC(GitHub - akashasingh0454/CVE-2026-0257-PoC), 2 stars, updated June 3, 2026). Two stars and no audit - before use, the code should be subtracted by hands.
