CVE-2026-0257: Palo Alto GlobalProtect Authentication Bypass Hit in the Wild Within Days of Disclosure
A credential-less VPN session forgery flaw in PAN-OS moved from 'medium severity, no known exploitation' to CISA's KEV catalog in sixteen days. Federal agencies had 72 hours to patch.
Palo Alto Networks initially rated CVE-2026-0257 medium severity when it published fixes on May 13. It said it was unaware of any exploitation. That characterization did not hold.
Rapid7 tracked successful exploitation across multiple customer environments beginning May 17 — four days after patches dropped. Attackers reached the network. In the cases Rapid7 reviewed, they did not push further, but the firm was unambiguous about the implications: treat this as critical regardless of the assigned score.
The flaw sits inside GlobalProtect, Palo Alto's remote-access VPN platform. The mechanism is a misconfiguration in how PAN-OS handles authentication override cookies. The gateway decrypts the cookie with a private key, then trusts its contents without verifying a signature. An attacker who can recover the public key — which the gateway exposes — can forge a cookie that looks completely legitimate and establish a VPN session without credentials, malware, or phishing.
The feature is off by default. Organizations that enabled it for user-experience reasons, often years ago, may have no idea they are exposed.
By May 29, Palo Alto revised its advisory. CVSS climbed to 7.8. Exploit maturity: "attacked." Urgency rating: highest. The same day, CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to remediate by June 1.
Three days to patch a VPN authentication bypass across a federal agency estate.
The risk profile here is worth spelling out. This is not remote code execution on the firewall. What it produces is a session that looks like a legitimate employee VPN connection. Detection is harder than with most intrusion techniques. From inside that session, an attacker can pursue lateral movement, credential harvesting, and persistence — all under the cover of an authenticated user.
The configuration dependency narrows the exposed population but does not shrink the risk for those inside it. The cookies must be enabled, and the certificate protecting them must also serve a secondary function such as the gateway's HTTPS interface. Teams that stood up this configuration and moved on face a gap in asset visibility that no zero-trust marketing deck anticipated.
Rapid7 recommended organizations audit GlobalProtect deployments immediately, confirm whether the vulnerable configuration is present, and apply available patches. Palo Alto's updated advisory provides mitigation guidance for environments that cannot patch immediately.
