~/news/2026-09-21-panos-globalprotect-cookie-auth-bypass.md

What happened. Palo Alto Networks published an advisory on 2026-05-13 for CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. A remote attacker with no credentials establishes an unauthorized VPN connection through the gateway. Rapid7's MDR saw successful exploitation across multiple customers from 2026-05-17 onward, all authentication attempts arriving from the same hosting provider. CISA added it to the Known Exploited Vulnerabilities catalog. No lateral movement from the affected appliances was observed.

Why it matters. This is the appliance that hands out remote access, and the bypass needs no credentials and no user interaction, so any second factor sitting behind the VPN is downstream of a door that is already open. The scoring history is the part worth carrying: the CVE shipped at CVSS 4.7 medium, then moved to 7.8 high on 2026-05-29 after exploitation was observed, and Rapid7 told customers to treat it as critical anyway. A score is a statement about a configuration and a moment, not a property of the bug.

Mechanism. The advisory names no component and no function, which is normal for this vendor. What makes this one diagnosable is the exploitation condition rather than the code path: Cloud Authentication Service disabled, and authentication override cookies enabled on the portal or gateway. Under that configuration an attacker presents a cookie rather than a credential, and the appliance accepts it against a local account. The log line carries the whole story in fields, and this is the shape to search for:

May 18 01:51:37 palovpn-01 1,2026/05/18 01:51:37,010101010101,GLOBALPROTECT,0,2817,
  2026/05/18 01:51:37,vsys1,gateway-auth,login,Cookie,,admin,US,GP-CLIENT,104.207.144.154,
  ...,"Auth latency: 78ms, profile: local_auth_profile",success,,0,,0,GP-Gateway

Read the fields, not the line: gateway-auth, the auth method Cookie, the account admin, GP-CLIENT, and success. An authentication that succeeds by cookie against a named local account is the event.

What to do. Update to a fixed release for your branch. PAN-OS 11.1 is fixed in 11.1.15, 11.2 in 11.2.12, 12.1 in 12.1.7, and 10.2 in 10.2.18-h6, with several earlier maintenance releases carrying backports listed in the advisory. Then hunt, because patching does not retract a session that already happened: search the GlobalProtect authentication log for successful Cookie logins, especially against accounts that should not be using them, and treat any that reach a local administrative account as a compromise rather than a curiosity. If nothing you run needs authentication override cookies, turn them off. That removes the reachable path rather than the bug, and it costs nothing.