Palo Alto Networks customers using GlobalProtect should treat CVE-2026-0257 as an urgent patching and configuration issue, especially if their deployment relies on authentication override cookies.
The vulnerability affects the GlobalProtect portal and gateway in PAN-OS under specific conditions. In vulnerable configurations, an attacker may be able to bypass authentication controls and establish an unauthorized VPN connection. That makes the flaw more serious than a typical edge-device bug, because a successful VPN connection can place an attacker closer to internal systems.
Palo Alto Networks has released fixes for the issue and has warned of limited exploitation attempts against unpatched devices where mitigations were not applied. CISA has also added the vulnerability to its Known Exploited Vulnerabilities catalog, which means U.S. federal civilian agencies are required to address it by June 1, 2026.
For private-sector teams, that deadline is still a useful signal: if GlobalProtect is exposed and the affected feature is enabled, this should not wait for the next routine maintenance window.
What Makes This GlobalProtect Flaw Risky
CVE-2026-0257 does not appear to affect every PAN-OS firewall running GlobalProtect. The risk depends on how the GlobalProtect portal or gateway is configured.
The vulnerable scenario involves authentication override cookies. These cookies are used to let GlobalProtect remember a user authentication state instead of forcing a full authentication flow every time. That can be useful operationally, but it also means the device must carefully validate the cookie before trusting it.
The reported weakness centers on how those cookies are handled when a particular certificate setup is in place. If the same certificate is reused for HTTPS services and for authentication override cookie handling, attackers may be able to craft cookies the appliance accepts as valid.
In practical terms, admins should focus on two questions:
- Is GlobalProtect portal or gateway enabled on the firewall?
- Are authentication override cookies enabled, and are they using a certificate that is also used elsewhere?
If both are true, the environment deserves immediate review, even before a broader vulnerability-management cycle catches up.
What Exploitation Reports Say
Rapid7 reported observing exploitation activity against customer environments beginning on May 17, 2026. Its investigation described attackers attempting to authenticate to GlobalProtect gateways with forged authentication override cookies, including attempts tied to local administrator accounts.
The activity did not always result in a complete VPN session. In several incidents, the appliance reportedly accepted the forged cookie, but the attacker still did not establish a full VPN connection. That distinction matters for incident response: a failed full session does not necessarily mean the device was unaffected, and logs may still show suspicious authentication behavior worth investigating.
Rapid7 also reported successful exploitation across multiple customers, while saying it had not observed confirmed lateral movement from the affected devices in those cases. Security teams should avoid treating that as a reason to relax. Edge VPN devices often sit at a sensitive boundary, and even limited authentication bypass activity can become a foothold if other controls are weak.
What Admins Should Do Now
The first step is to install the fixed PAN-OS version recommended by Palo Alto Networks for the affected branch. Patching is the cleanest fix, and Palo Alto notes that updated software regenerates GlobalProtect authentication override cookies using a more secure method.
Teams that cannot patch immediately should reduce exposure by changing the risky configuration. Palo Alto’s mitigation guidance centers on either disabling authentication override or using a dedicated certificate for that feature.
A practical response plan looks like this:
- Identify all PAN-OS devices running a GlobalProtect portal or gateway.
- Check whether authentication override cookies are enabled.
- Confirm whether the certificate used for authentication override cookies is dedicated to that purpose.
- Install the applicable PAN-OS security update as soon as possible.
- If patching is delayed, disable authentication override or move it to a dedicated certificate that is not reused for HTTPS or other services.
- Review GlobalProtect authentication logs for unusual cookie-based authentication attempts since at least May 17, 2026.
- Look for successful VPN connections from unfamiliar infrastructure, unexpected users, or impossible travel patterns.
How To Prioritize Investigation
Because this is a VPN authentication issue, the investigation should not stop at whether the firewall is patched. Security teams should also determine whether any suspicious authentication attempt led to network access.
Useful log review questions include:
- Were there successful GlobalProtect logins for local administrator or rarely used accounts?
- Did any session originate from hosting providers or unfamiliar autonomous systems?
- Were accepted authentication override cookies followed by a complete VPN tunnel?
- Did the same source attempt multiple users or repeat the pattern across gateways?
- Was there any subsequent access to internal services, identity systems, file shares, or management interfaces?
If suspicious VPN access is confirmed, rotate relevant credentials, revoke active sessions, review administrator accounts, and preserve logs before making major changes. For higher-risk environments, this should be handled as a potential boundary compromise rather than a simple patch ticket.
The Bottom Line
CVE-2026-0257 is not just a theoretical GlobalProtect weakness. Exploitation has been reported, CISA has placed the issue in the KEV catalog, and the vulnerable configuration involves a remote-access path into corporate networks.
Admins should patch affected PAN-OS devices, remove risky certificate reuse, and review GlobalProtect authentication activity from mid-May onward. If authentication override cookies are not needed, disabling the feature is the simplest way to shrink the attack surface while patching and log review continue.